The RF register query reads a 32-bit value after an eight-byte response prefix without checking the skb length. A truncated firmware response can cause an out-of-bounds read. Require the prefix and register value before accessing the response. Fixes: 0a17329ae9c1 ("mt76: mt7915: add debugfs knob for RF registers read/write") Signed-off-by: Jiale Yao --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 4a11a4a0dbde..650ee9134ddf 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -4256,6 +4256,10 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set) &req, sizeof(req), true, &skb); if (ret) return ret; + if (skb->len < 8 + sizeof(__le32)) { + dev_kfree_skb(skb); + return -EINVAL; + } *val = le32_to_cpu(*(__le32 *)(skb->data + 8)); dev_kfree_skb(skb); -- 2.34.1