Skip to content

Fix VIF WCID collision, unchecked MCU returns, and firmware validation overflow in mt76x02/mt76x2 #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HiGarfield merged 3 commits into from
Mar 31, 2026
Merged

Fix VIF WCID collision, unchecked MCU returns, and firmware validation overflow in mt76x02/mt76x2 #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f8770d9
Fix bugs in mt76x02/mt76x2 code: VIF WCID collision, unchecked MCU re…
Copilot Mar 31, 2026
df6dad5
Add firmware length alignment and INT_MAX bounds checks for ilm_len/d…
Copilot Mar 31, 2026
3b23a2a
Reorder firmware validation: bounds checks before alignment check
Copilot Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions mt76x02_mac.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@ struct mt76x02_tx_status {
u16 rate;
} __packed __aligned(2);

#define MT_VIF_WCID(_n) (254 - ((_n) & 7))
#define MT_MAX_VIFS 8
#define MT_VIF_WCID(_n) (254 - ((_n) & 0xf))
#define MT_MAX_VIFS 16

#define MT_PKTID_RATE GENMASK(4, 0)
#define MT_PKTID_AC GENMASK(6, 5)
Expand Down
7 changes: 6 additions & 1 deletion mt76x2/mcu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,13 @@ int mt76x2_mcu_set_channel(struct mt76x02_dev *dev, u8 channel, u8 bw,
.chainmask = cpu_to_le16(dev->chainmask),
};

int ret;

/* first set the channel without the extension channel info */
mt76_mcu_send_msg(dev, CMD_SWITCH_CHANNEL_OP, &msg, sizeof(msg), true);
ret = mt76_mcu_send_msg(dev, CMD_SWITCH_CHANNEL_OP, &msg, sizeof(msg),
true);
if (ret)
return ret;

usleep_range(5000, 10000);

Expand Down
24 changes: 12 additions & 12 deletions mt76x2/pci_mcu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,8 @@ mt76pci_load_firmware(struct mt76x02_dev *dev)
{
const struct firmware *fw;
const struct mt76x02_fw_header *hdr;
int len, ret;
int ret;
u32 ilm_len, dlm_len;
__le32 *cur;
u32 offset, val;

Expand All @@ -95,11 +96,13 @@ mt76pci_load_firmware(struct mt76x02_dev *dev)

hdr = (const struct mt76x02_fw_header *)fw->data;

len = sizeof(*hdr);
len += le32_to_cpu(hdr->ilm_len);
len += le32_to_cpu(hdr->dlm_len);
ilm_len = le32_to_cpu(hdr->ilm_len);
dlm_len = le32_to_cpu(hdr->dlm_len);

if (fw->size != len)
if (ilm_len > INT_MAX || dlm_len > INT_MAX ||
(ilm_len | dlm_len) & 3 ||
ilm_len > fw->size - sizeof(*hdr) ||
dlm_len != fw->size - sizeof(*hdr) - ilm_len)
goto error;

val = le16_to_cpu(hdr->fw_ver);
Expand All @@ -111,21 +114,19 @@ mt76pci_load_firmware(struct mt76x02_dev *dev)
dev_info(dev->mt76.dev, "Build Time: %.16s\n", hdr->build_time);

cur = (__le32 *)(fw->data + sizeof(*hdr));
len = le32_to_cpu(hdr->ilm_len);

mt76_wr(dev, MT_MCU_PCIE_REMAP_BASE4, MT_MCU_ILM_OFFSET);
mt76_wr_copy(dev, MT_MCU_ILM_ADDR, cur, len);
mt76_wr_copy(dev, MT_MCU_ILM_ADDR, cur, ilm_len);

cur += len / sizeof(*cur);
len = le32_to_cpu(hdr->dlm_len);
cur += ilm_len / sizeof(*cur);

if (mt76xx_rev(dev) >= MT76XX_REV_E3)
offset = MT_MCU_DLM_ADDR_E3;
else
offset = MT_MCU_DLM_ADDR;

mt76_wr(dev, MT_MCU_PCIE_REMAP_BASE4, MT_MCU_DLM_OFFSET);
mt76_wr_copy(dev, offset, cur, len);
mt76_wr_copy(dev, offset, cur, dlm_len);

mt76_wr(dev, MT_MCU_PCIE_REMAP_BASE4, 0);

Expand Down Expand Up @@ -192,6 +193,5 @@ int mt76x2_mcu_init(struct mt76x02_dev *dev)
if (ret)
return ret;

mt76x02_mcu_function_select(dev, Q_SELECT, 1);
return 0;
return mt76x02_mcu_function_select(dev, Q_SELECT, 1);
}
9 changes: 6 additions & 3 deletions mt76x2/usb_mcu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,8 @@ static int mt76x2u_mcu_load_firmware(struct mt76x02_dev *dev)
{
u32 val, dlm_offset = MT76U_MCU_DLM_OFFSET;
const struct mt76x02_fw_header *hdr;
int err, len, ilm_len, dlm_len;
int err;
u32 ilm_len, dlm_len;
const struct firmware *fw;

err = request_firmware(&fw, MT7662_FIRMWARE, dev->mt76.dev);
Expand All @@ -160,8 +161,10 @@ static int mt76x2u_mcu_load_firmware(struct mt76x02_dev *dev)
hdr = (const struct mt76x02_fw_header *)fw->data;
ilm_len = le32_to_cpu(hdr->ilm_len);
dlm_len = le32_to_cpu(hdr->dlm_len);
len = sizeof(*hdr) + ilm_len + dlm_len;
if (fw->size != len) {

if (ilm_len > INT_MAX || dlm_len > INT_MAX ||
ilm_len > fw->size - sizeof(*hdr) ||
dlm_len != fw->size - sizeof(*hdr) - ilm_len) {
err = -EINVAL;
goto out;
}
Expand Down