[PATCH 0/2] wifi: mt76: fix USB copy source overreads

[Jiale Yao]

The USB copy helpers round up the caller's length to four bytes and
then use the rounded length as the bound for memcpy() from the source
buffer. If the caller supplies a length that is not a multiple of four,
the final transfer reads one to three bytes past the source buffer.
The beacon write path can pass such an unaligned length.

The MMIO copy helpers already handle their unaligned tail through a
four-byte bounce buffer. Apply the same principle to the USB helpers:
keep the original length as the source-copy bound and zero the unused
bytes in the transmit buffer so that the register access width remains
four-byte aligned.

The two patches are independent and both apply to the same baseline:

  wifi: mt76: usb: fix source overread in mt76u_copy
  wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy

Jiale Yao (2):
  wifi: mt76: usb: fix source overread in mt76u_copy
  wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy

 drivers/net/wireless/mediatek/mt76/mt7615/usb.c | 17 ++++++++++++-----
 drivers/net/wireless/mediatek/mt76/usb.c        | 16 +++++++++++-----
 2 files changed, 23 insertions(+), 10 deletions(-)

-- 
2.34.1