[PATCH 0/7] wifi: mt76: validate mt7996 MCU responses

[Jiale Yao]

Several mt7996 MCU paths trust firmware response sizes before reading
receive descriptors, fixed events, or variable data. The asynchronous
IE countdown handler also walks firmware TLVs without bounding their
lengths. Malformed responses can therefore cause out-of-bounds reads.

Validate fixed response fields and payloads, and constrain the IE
countdown TLV walk to the skb.

Jiale Yao (7):
  wifi: mt76: mt7996: validate MCU response lengths
  wifi: mt76: mt7996: bound IE countdown event parsing
  wifi: mt76: mt7996: validate EEPROM response lengths
  wifi: mt76: mt7996: validate free-block response length
  wifi: mt76: mt7996: validate channel MIB response length
  wifi: mt76: mt7996: validate temperature response length
  wifi: mt76: mt7996: validate RF register response length

 .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 97 ++++++++++++++++---
 1 file changed, 85 insertions(+), 12 deletions(-)

-- 
2.34.1