From nobody Fri Jul 24 23:30:48 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB6AA33ADBA for ; Wed, 22 Jul 2026 07:04:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784703854; cv=none; b=LQQ7ZAJzCfbAkzkPvmuHS/xIx26BdfzNgth1VxJjqNn+idDrumSd/tOyOtcCFGEgOuiDyPUFEXvBP450cYdek+JAD0WKczyjTQixbUHiaGWsu+GCP+x5TZ1H7w1CcbbBcjFA5EviEN5iQTBNC6EDRcqskMy0TzvHEkFhWTA1RG4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784703854; c=relaxed/simple; bh=83gSPMppkIBdi3KJ54tc7FfH3R8OAWjFNfADpRQix+s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ld713TkTA/6jGQ1tnaECUFnmP+G+xnRbXG5SlA+vXc+HJm18GEPQUPmRp+6z2EQ0c5c9LPbA2LFsnd3oTUeg2ByeHEXUestkMIvRUm9scnqEDfIEiQ4nj53BqmzYGpx2dqFj5LgYuDIoodQEzMq4iTevIew9caDD10BoJtPS+Vw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=j+6fGdUR; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="j+6fGdUR" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-383cb94f742so11370239a91.3 for ; Wed, 22 Jul 2026 00:04:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784703852; x=1785308652; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8bdrG0QFqxIH5pXZGRRRAY6FI2BH/CW3w4wZSetZqPY=; b=j+6fGdUR1EN4QVfODYrerrWAbqdRQv4lFE9+D97va8hANJgoJQPOaNdWs2fmll13U5 Jjwbshxw6fcG8d9jxYbJkLrmmthJql19Adko6/985sHwIs0qxZwp+4EKvnk5BPyPxLWp RL3kjdvIWYVYQswbDAXT4/8yXqsHc8G3prfZWrcLhg58imQe4aZa2ZZ1IoHPJ99uvWhP y4nm0woGxB9wX0EB0S9LAkyj681bM3wGs0gBZ6+b5eV0IdUInmYZvbbNYyMeyGXba+3e /gykE+aLzBuVINhq8+OjN7MUgwuJd6I+szQg+D14SCmpbDVMDm1y6+0eQ9j4DHNmjLTV XOlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784703852; x=1785308652; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8bdrG0QFqxIH5pXZGRRRAY6FI2BH/CW3w4wZSetZqPY=; b=ekvSkFWA2bNPZL2+vHX6KQo0JaJ4RIsaQThdPITNeUs+Gw5wo3pikd6TJBmhXOtkY/ zyuwiBeKhAjiQSo4TxxJvPumdd+m01FRUqjmHTKlTDWGOJbEtmD+ugOnLLaTmTkXPiGv LWJXW7CwMYBAkWecs9vm7wUio88/+g623uNM3LE5G/JbCRT7L+efZirgGEm1qNf3bBbV 7azL+LzT4vJjo1r3/OLGcu6NNkBXZLtXIOmmgC/SGuZsL0OnQFp872bsuZaNP3yKYbUb b5h2oZAnSmXQjk9CsNg2ewxy90zyskqloC7yYj7DFgNQlIsL1e+joIxQaFX0tp/Mb6KD eMlg== X-Forwarded-Encrypted: i=1; AHgh+RpTOGP5Cuve35k/O+iO1qD5fZ0fyDHksgv4q9brlyLQytTniO4Kwcq/4wt905NzoOsH9VE8K2EarWvsMPY=@vger.kernel.org X-Gm-Message-State: AOJu0YyBfRb21hxINMTH/hfFAJch4hrppidvF8zi6n0XLbo4IJOt4kOa 7KJgsg03nQwBh1iN6Gi/DtuIPN+eQgTQTLpRBpAyqt1jvQlCECsbbrny X-Gm-Gg: AR+sD11aZmd6MgAttddNLPZj6AL3ay9hQwRec1+uzqlMdyVHnb4sMZNe/u20bRw8tPj olahzg1Q9o/Wd8eCOnuGnO7Ip3FiZPVdc2qYqIX0nTqFdD529JUj2azEsml8PZWs+94M6NsU7xM B0YsPlUTgEOM9NWe1Gi0Aqenw0xMr2w7h0Uaa/SCB/VpMhJAaDCJuzSGlOniEsb4Gd7bPVOgzd2 56nqlaqXsbug3Jf58GXcp+NemsskuO5nbfBlDT+VRUzW04wKaH7iWoNe0CQMC0/Z9FPjEmI2WYI a9PHOrLqilpE8LjOgCk4CMejXbouVGFhZGsHE80We2lzf01LiLk2VMqVX4tXchGvQnNgqqTa4QP G/fA5eSsM9Yk2+iwoMDmtJ4x2l1yEtVTkeHubbT2AxiYzlTOAg6iR3YDfjziyUiDRqKaGKeEWuq o+8XvLL0/+tPRopvQv8NtqvkpzzGAwJh0ILAtXICcOEa8EJwsatYnih4wjvmGzuopuKKmVLx4DI N1aCmmNpopSNe4a3q22BIE= X-Received: by 2002:a17:90b:2e90:b0:368:ed26:15b2 with SMTP id 98e67ed59e1d1-38e4b43c408mr21798100a91.8.1784703851941; Wed, 22 Jul 2026 00:04:11 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13d130a8421sm3203259c88.10.2026.07.22.00.04.06 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 22 Jul 2026 00:04:11 -0700 (PDT) From: Laxman Acharya Padhya To: Felix Fietkau , Lorenzo Bianconi , Ryder Lee Cc: Shayne Chen , Sean Wang , Matthias Brugger , AngeloGioacchino Del Regno , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, stable@vger.kernel.org, Laxman Acharya Padhya Subject: [PATCH] wifi: mt76: mt7925: validate CLC firmware records Date: Wed, 22 Jul 2026 12:49:02 +0545 Message-ID: <20260722070402.45328-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end. Validate the table and record bounds before dereferencing or copying. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt= 7925 chips") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- .../net/wireless/mediatek/mt76/mt7925/mcu.c | 32 ++++++++++++++----- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/= wireless/mediatek/mt76/mt7925/mcu.c index e94fa544ff20..76e30bf4ce0f 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c @@ -803,8 +803,9 @@ static int mt7925_load_clc(struct mt792x_dev *dev, cons= t char *fw_name) struct mt76_dev *mdev =3D &dev->mt76; struct mt792x_phy *phy =3D &dev->phy; const struct firmware *fw; + size_t clc_len, fw_data_len, len, offset =3D 0; u8 *clc_base =3D NULL, hw_encap =3D 0; - int ret, i, len, offset =3D 0; + int ret, i; =20 dev->phy.clc_chan_conf =3D 0xff; dev->regd_user =3D false; @@ -829,13 +830,21 @@ static int mt7925_load_clc(struct mt792x_dev *dev, co= nst char *fw_name) } =20 hdr =3D (const void *)(fw->data + fw->size - sizeof(*hdr)); + if (hdr->n_region > (fw->size - sizeof(*hdr)) / sizeof(*region)) { + dev_err(mdev->dev, "Invalid firmware region table\n"); + ret =3D -EINVAL; + goto out; + } + fw_data_len =3D fw->size - sizeof(*hdr) - + hdr->n_region * sizeof(*region); + for (i =3D 0; i < hdr->n_region; i++) { region =3D (const void *)((const u8 *)hdr - (hdr->n_region - i) * sizeof(*region)); len =3D le32_to_cpu(region->len); =20 /* check if we have valid buffer size */ - if (offset + len > fw->size) { + if (len > fw_data_len - offset) { dev_err(mdev->dev, "Invalid firmware region\n"); ret =3D -EINVAL; goto out; @@ -852,11 +861,19 @@ static int mt7925_load_clc(struct mt792x_dev *dev, co= nst char *fw_name) if (!clc_base) goto out; =20 - for (offset =3D 0; offset < len; offset +=3D le32_to_cpu(clc->len)) { - clc =3D (const struct mt7925_clc *)(clc_base + offset); + for (offset =3D 0; offset < len; offset +=3D clc_len) { + if (len - offset < sizeof(*clc)) { + ret =3D -EINVAL; + goto out; + } =20 - if (clc->idx >=3D ARRAY_SIZE(phy->clc)) - break; + clc =3D (const struct mt7925_clc *)(clc_base + offset); + clc_len =3D le32_to_cpu(clc->len); + if (clc_len < sizeof(*clc) || clc_len > len - offset || + clc->idx >=3D ARRAY_SIZE(phy->clc)) { + ret =3D -EINVAL; + goto out; + } =20 /* do not init buf again if chip reset triggered */ if (phy->clc[clc->idx]) @@ -869,8 +886,7 @@ static int mt7925_load_clc(struct mt792x_dev *dev, cons= t char *fw_name) continue; =20 phy->clc[clc->idx] =3D devm_kmemdup(mdev->dev, clc, - le32_to_cpu(clc->len), - GFP_KERNEL); + clc_len, GFP_KERNEL); =20 if (!phy->clc[clc->idx]) { ret =3D -ENOMEM; --=20 2.51.2