[PATCH 3/3] wifi: mt76: mt7925: validate NIC capability payload lengths

[Jiale Yao]

The NIC capability parser only checks whether a declared TLV length fits
in the skb. It does not reject lengths shorter than the TLV header or
ensure that known payloads contain the fields consumed by the driver. A
truncated firmware response can therefore stall the parser on a zero
length TLV or cause out-of-bounds reads from fixed-size payloads.

Reject undersized TLVs and validate every known payload before accessing
it.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 .../net/wireless/mediatek/mt76/mt7925/mcu.c   | 43 +++++++++++++++----
 1 file changed, 35 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index c612fda55eb7..41138203ada2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -1039,8 +1039,8 @@ int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
 	return temperature;
 }
 
-static void
-mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
+static bool
+mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data, int len)
 {
 	struct mt76_phy *mphy = &dev->mt76.phy;
 	struct mt76_dev *mdev = mphy->dev;
@@ -1064,16 +1064,21 @@ mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
 		WF0_5G
 	};
 
+	if (len < sizeof(*cap))
+		return false;
+
 	cap = (struct mt7925_mcu_phy_cap *)data;
 
 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
 	mdev->phy.chainmask = mdev->phy.antenna_mask;
 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
+
+	return true;
 }
 
-static void
-mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
+static bool
+mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data, int len)
 {
 	struct mt7925_mcu_eml_cap {
 		u8 rsv[4];
@@ -1081,9 +1086,14 @@ mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
 		u8 rsv2[6];
 	} __packed * cap;
 
+	if (len < sizeof(*cap))
+		return false;
+
 	cap = (struct mt7925_mcu_eml_cap *)data;
 
 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
+
+	return true;
 }
 
 static int
@@ -1121,36 +1131,53 @@ mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
 
 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
 		struct tlv *tlv = (struct tlv *)skb->data;
-		int len;
+		int data_len, len;
 
 		if (skb->len < sizeof(*tlv))
 			break;
 
 		len = le16_to_cpu(tlv->len);
-		if (skb->len < len)
+		if (len < sizeof(*tlv) || skb->len < len)
 			break;
+		data_len = len - sizeof(*tlv);
 
 		switch (le16_to_cpu(tlv->tag)) {
 		case MT_NIC_CAP_6G:
+			if (len < sizeof(*tlv) + sizeof(tlv->data[0]))
+				goto invalid;
+
 			mphy->cap.has_6ghz = !!tlv->data[0];
 			break;
 		case MT_NIC_CAP_MAC_ADDR:
+			if (len < sizeof(*tlv) + ETH_ALEN)
+				goto invalid;
+
 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
 			break;
 		case MT_NIC_CAP_PHY:
-			mt7925_mcu_parse_phy_cap(dev, tlv->data);
+			if (!mt7925_mcu_parse_phy_cap(dev, tlv->data, data_len))
+				goto invalid;
 			break;
 		case MT_NIC_CAP_CHIP_CAP:
+			if (len < sizeof(*tlv) + sizeof(__le64))
+				goto invalid;
+
 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
 			break;
 		case MT_NIC_CAP_EML_CAP:
-			mt7925_mcu_parse_eml_cap(dev, tlv->data);
+			if (!mt7925_mcu_parse_eml_cap(dev, tlv->data, data_len))
+				goto invalid;
 			break;
 		default:
 			break;
 		}
 		skb_pull(skb, len);
 	}
+
+	goto out;
+
+invalid:
+	ret = -EINVAL;
 out:
 	dev_kfree_skb(skb);
 	return ret;
-- 
2.34.1