The EFUSE free-block query reads a byte after an eight-byte prefix without checking the firmware response length. A truncated response can cause an out-of-bounds read. Require the prefix and block-count byte before accessing the response. Fixes: f456e1f56c4c ("wifi: mt76: add external EEPROM support for mt799x chipsets") Signed-off-by: Jiale Yao --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index eb868c2d5108..c70d7ad3148c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -4516,6 +4516,10 @@ int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num) sizeof(req), true, &skb); if (ret) return ret; + if (skb->len < 8 + sizeof(*block_num)) { + dev_kfree_skb(skb); + return -EINVAL; + } *block_num = *(u8 *)(skb->data + 8); dev_kfree_skb(skb); -- 2.34.1