As sizeof(hdr->build_date) is 16 we reading 17 bytes (sizeof(build_date)) result in the following error: [ T378] ------------[ cut here ]------------ [ T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16 [ T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378 [...] [ T378] mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib] [ T378] mt792x_load_firmware+0x31/0x140 [mt792x_lib] Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate") Signed-off-by: Bert Karwatzki --- drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c index ea99167765b0..aca3d7870dce 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c @@ -3125,7 +3125,7 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name) } hdr = (const void *)fw->data; - strscpy(build_date, hdr->build_date, sizeof(build_date)); + strscpy(build_date, hdr->build_date, sizeof(hdr->build_date)); build_date[16] = '\0'; strim(build_date); dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n", -- 2.47.3 In linux-next-20251217 I noticed the following error during boot: [ T378] ------------[ cut here ]------------ [ T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16 [ T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378 [ T378] Modules linked in: mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics configfs efi_pstore efivarfs autofs4 ext4 mbcache jbd2 amdgpu usbhid drm_client_lib i2c_algo_bit drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_buddy xhci_pci drm_panel_backlight_quirks gpu_sched amdxcp xhci_hcd hid_sensor_hub drm_display_helper mfd_core hid_multitouch hid_generic psmouse usbcore nvme drm_kms_helper i2c_hid_acpi amd_sfh i2c_hid hid serio_raw nvme_core cec i2c_piix4 r8169 i2c_smbus usb_common crc16 i2c_designware_platform i2c_designware_core [ T378] CPU: 15 UID: 0 PID: 378 Comm: kworker/15:1 Not tainted 6.19.0-rc1-next-20251217-master #262 PREEMPT_{RT,(full)} [ T378] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-158L, BIOS E158LAMS.10F 11/11/2024 [ T378] Workqueue: events mt7921_init_work [mt7921_common] [ T378] RIP: 0010:__fortify_report+0x3e/0x50 [ T378] Code: 39 c8 48 0f 47 c1 83 e7 01 48 c7 c1 29 ac 54 95 48 8b 34 c5 e0 d5 26 95 48 c7 c0 8c 8f 54 95 48 0f 44 c8 48 8d 3d 42 ba c7 00 <67> 48 0f b9 3a e9 d3 aa a5 ff 0f 1f 84 00 00 00 00 00 f3 0f 1e fa [ T378] RSP: 0018:ffffb015823a7d18 EFLAGS: 00010246 [ T378] RAX: ffffffff95548f8c RBX: 0000000000000000 RCX: ffffffff95548f8c [ T378] RDX: 0000000000000011 RSI: ffffffff955319d6 RDI: ffffffff95925070 [ T378] RBP: ffff8ebf90f22560 R08: 0000000000000010 R09: ffffb01581f8d000 [ T378] R10: ffff8ebf80042700 R11: ffff8ec23a7e5930 R12: 0000000000000000 [ T378] R13: ffffb01581f8d000 R14: 0000000000001000 R15: 0000000000000000 [ T378] FS: 0000000000000000(0000) GS:ffff8ec2a49de000(0000) knlGS:0000000000000000 [ T378] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T378] CR2: 00007f861de85114 CR3: 0000000025222000 CR4: 0000000000750ef0 [ T378] PKRU: 55555554 [ T378] Call Trace: [ T378] [ T378] __fortify_panic+0xd/0xf [ T378] mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib] [ T378] mt792x_load_firmware+0x31/0x140 [mt792x_lib] [ T378] mt7921_run_firmware+0x27/0x490 [mt7921_common] [ T378] ? srso_alias_return_thunk+0x5/0xfbef5 [ T378] ? srso_alias_return_thunk+0x5/0xfbef5 [ T378] ? ____mt76_poll_msec+0x70/0xb0 [mt76] [ T378] mt7921e_mcu_init+0x47/0x75 [mt7921e] [ T378] mt7921_init_work+0x4c/0x190 [mt7921_common] [ T378] process_one_work+0x17b/0x290 [ T378] worker_thread+0x17d/0x2e0 [ T378] ? bh_worker+0x1c0/0x1c0 [ T378] kthread+0xe9/0x1e0 [ T378] ? kthreads_online_cpu+0x100/0x100 [ T378] ? kthreads_online_cpu+0x100/0x100 [ T378] ret_from_fork+0x23e/0x270 [ T378] ? kthreads_online_cpu+0x100/0x100 [ T378] ret_from_fork_asm+0x11/0x20 [ T378] [ T378] ---[ end trace 0000000000000000 ]--- [ T378] ------------[ cut here ]------------ [ T378] kernel BUG at lib/string_helpers.c:1044! [ T378] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ T378] CPU: 15 UID: 0 PID: 378 Comm: kworker/15:1 Tainted: G W 6.19.0-rc1-next-20251217-master #262 PREEMPT_{RT,(full)} [ T378] Tainted: [W]=WARN [ T378] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-158L, BIOS E158LAMS.10F 11/11/2024 [ T378] Workqueue: events mt7921_init_work [mt7921_common] [ T378] RIP: 0010:__fortify_panic+0xd/0xf [ T378] Code: d6 e8 57 e6 fe ff 48 89 df e8 7f 5c 23 00 e9 21 80 48 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 40 0f b6 ff e8 53 c1 48 00 <0f> 0b 48 8b 54 24 08 48 8b 34 24 4c 8d 44 24 1d 4c 89 e9 48 c7 c7 [ T378] RSP: 0018:ffffb015823a7d20 EFLAGS: 00010246 [ T378] RAX: ffffffff95548f8c RBX: 0000000000000000 RCX: ffffffff95548f8c [ T378] RDX: 0000000000000011 RSI: ffffffff955319d6 RDI: ffffffff95925070 [ T378] RBP: ffff8ebf90f22560 R08: 0000000000000010 R09: ffffb01581f8d000 [ T378] R10: ffff8ebf80042700 R11: ffff8ec23a7e5930 R12: 0000000000000000 [ T378] R13: ffffb01581f8d000 R14: 0000000000001000 R15: 0000000000000000 [ T378] FS: 0000000000000000(0000) GS:ffff8ec2a49de000(0000) knlGS:0000000000000000 [ T378] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T378] CR2: 00007f861de85114 CR3: 0000000025222000 CR4: 0000000000750ef0 [ T378] PKRU: 55555554 [ T378] Call Trace: [ T378] [ T378] mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib] [ T378] mt792x_load_firmware+0x31/0x140 [mt792x_lib] [ T378] mt7921_run_firmware+0x27/0x490 [mt7921_common] [ T378] ? srso_alias_return_thunk+0x5/0xfbef5 [ T378] ? srso_alias_return_thunk+0x5/0xfbef5 [ T378] ? ____mt76_poll_msec+0x70/0xb0 [mt76] [ T378] mt7921e_mcu_init+0x47/0x75 [mt7921e] [ T378] mt7921_init_work+0x4c/0x190 [mt7921_common] [ T378] process_one_work+0x17b/0x290 [ T378] worker_thread+0x17d/0x2e0 [ T378] ? bh_worker+0x1c0/0x1c0 [ T378] kthread+0xe9/0x1e0 [ T378] ? kthreads_online_cpu+0x100/0x100 [ T378] ? kthreads_online_cpu+0x100/0x100 [ T378] ret_from_fork+0x23e/0x270 [ T378] ? kthreads_online_cpu+0x100/0x100 [ T378] ret_from_fork_asm+0x11/0x20 [ T378] [ T378] Modules linked in: mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics configfs efi_pstore efivarfs autofs4 ext4 mbcache jbd2 amdgpu usbhid drm_client_lib i2c_algo_bit drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_buddy xhci_pci drm_panel_backlight_quirks gpu_sched amdxcp xhci_hcd hid_sensor_hub drm_display_helper mfd_core hid_multitouch hid_generic psmouse usbcore nvme drm_kms_helper i2c_hid_acpi amd_sfh i2c_hid hid serio_raw nvme_core cec i2c_piix4 r8169 i2c_smbus usb_common crc16 i2c_designware_platform i2c_designware_core [ T378] ---[ end trace 0000000000000000 ]--- The result of this is that my wireless card doesn't work. The patch above fixes the issue. Bert Karwatzki