The free-block query reads the first response byte without checking that the firmware returned any payload. A zero-length response can therefore cause an out-of-bounds read. Require the block-count byte before accessing it. Fixes: bbc1d4154ec1 ("mt76: mt7915: add default calibrated data support") Signed-off-by: Jiale Yao --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 7009a3a3edd2..05614b99165b 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -2985,6 +2985,10 @@ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num) &req, sizeof(req), true, &skb); if (ret) return ret; + if (skb->len < sizeof(*block_num)) { + dev_kfree_skb(skb); + return -EINVAL; + } *block_num = *(u8 *)skb->data; dev_kfree_skb(skb); -- 2.34.1