[PATCH 01/10] wifi: mt76: mt7603: validate MCU response length

[Jiale Yao]

The MCU response parser reads the sequence number from the receive
descriptor without first ensuring that the descriptor is present. A
truncated firmware response can therefore cause an out-of-bounds read.

Reject responses shorter than the receive descriptor before accessing
the sequence number.

Fixes: f320d812b7bb ("mt76: implement .mcu_parse_response in struct mt76_mcu_ops")
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/net/wireless/mediatek/mt76/mt7603/mcu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7603/mcu.c
index e432cce97640..b231fb2d3752 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mcu.c
@@ -26,6 +26,8 @@ mt7603_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 		dev->mcu_hang = MT7603_WATCHDOG_TIMEOUT;
 		return -ETIMEDOUT;
 	}
+	if (skb->len < sizeof(*rxd))
+		return -EINVAL;
 
 	rxd = (struct mt7603_mcu_rxd *)skb->data;
 	if (seq != rxd->seq)
-- 
2.34.1