The RX rate query reads a complete PHY information structure without checking the response length. A truncated firmware response can cause out-of-bounds reads while decoding the rate. Require the complete PHY RX information structure before using it. Fixes: 11553d88d0b9 ("mt76: mt7915: query station rx rate from firmware") Signed-off-by: Jiale Yao --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 955c0e6c7cb6..00a528694255 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -3942,6 +3942,10 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif, &req, sizeof(req), true, &skb); if (ret) return ret; + if (skb->len < sizeof(*res)) { + dev_kfree_skb(skb); + return -EINVAL; + } res = (struct mt7915_mcu_phy_rx_info *)skb->data; -- 2.34.1