The RF register query reads a fixed firmware response without checking its length. A truncated response can cause an out-of-bounds read. Require the complete register response before accessing its value. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Jiale Yao --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index d87851c5fc1d..c248055a2c94 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -5379,6 +5379,10 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set) &req, sizeof(req), true, &skb); if (ret) return ret; + if (skb->len < sizeof(*res)) { + dev_kfree_skb(skb); + return -EINVAL; + } res = (void *)skb->data; *val = le32_to_cpu(res->data); -- 2.34.1