[PATCH 10/10] wifi: mt76: mt7915: validate RF register response length

[Jiale Yao]

The RF register query reads a 32-bit value after an eight-byte response
prefix without checking the skb length. A truncated firmware response
can cause an out-of-bounds read.

Require the prefix and register value before accessing the response.

Fixes: 0a17329ae9c1 ("mt76: mt7915: add debugfs knob for RF registers read/write")
Signed-off-by: Jiale Yao <yaojiale_2026@xxxxxx>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 4a11a4a0dbde..650ee9134ddf 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -4256,6 +4256,10 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < 8 + sizeof(__le32)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
 	dev_kfree_skb(skb);
-- 
2.34.1