mt7915_mcu_muru_debug_get() treats the firmware response as a complete statistics structure without checking its length. A truncated response can cause out-of-bounds reads while accumulating the counters. Reject responses shorter than the expected statistics structure. Fixes: 1966a5078f2d ("mt76: mt7915: add mu-mimo and ofdma debugfs knobs") Signed-off-by: Jiale Yao --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 3643906cbdf2..6d777dcfa2c1 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -2256,6 +2256,10 @@ int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy) &req, sizeof(req), true, &skb); if (ret) return ret; + if (skb->len < sizeof(*mu_stats)) { + dev_kfree_skb(skb); + return -EINVAL; + } mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data); -- 2.34.1