[PATCH 10/11] wifi: mt76: mt7925: validate radio status response

[Jiale Yao]

The radio status query removes an outer TLV header and reads the status
event without checking the response length. A truncated firmware
response can cause an out-of-bounds read.

Require both the outer TLV header and complete status event before
pulling the skb.

Fixes: e54b870212c0 ("wifi: mt76: mt7925: add rfkill_poll for hardware rfkill")
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index f37d2a8eafe6..0baef78148d1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -4140,6 +4140,10 @@ int mt7925_mcu_wf_rf_pin_ctrl(struct mt792x_phy *phy)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(struct tlv) + sizeof(*status)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	skb_pull(skb, sizeof(struct tlv));
 	status = (struct mt7925_radio_status_event *)skb->data;
-- 
2.34.1