From: Mario Limonciello <superm1@kernel•org>
To: Bert Karwatzki <spasswolf@web•de>
Cc: Felix Fietkau <nbd@nbd•name>,
linux-kernel@vger•kernel.org, linux-wireless@vger•kernel.org,
linux-next@vger•kernel.org
Subject: Re: [PATCH] wifi: mt76: connac: fix out of bounds read in mt76_connac2_load_patch()
Date: Wed, 17 Dec 2025 16:28:18 -0600 [thread overview]
Message-ID: <8de4b48d-1e25-4334-8afb-1b5d279fb483@kernel.org> (raw)
In-Reply-To: <20251217222622.8161-1-spasswolf@web.de>
On 12/17/25 4:26 PM, Bert Karwatzki wrote:
> As sizeof(hdr->build_date) is 16 we reading 17 bytes (sizeof(build_date))
> result in the following error:
>
> [ T378] ------------[ cut here ]------------
> [ T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16
> [ T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378
> [...]
> [ T378] mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
> [ T378] mt792x_load_firmware+0x31/0x140 [mt792x_lib]
>
> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
>
> Signed-off-by: Bert Karwatzki <spasswolf@web•de>
> ---
> drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> index ea99167765b0..aca3d7870dce 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> @@ -3125,7 +3125,7 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
> }
>
> hdr = (const void *)fw->data;
> - strscpy(build_date, hdr->build_date, sizeof(build_date));
> + strscpy(build_date, hdr->build_date, sizeof(hdr->build_date));
> build_date[16] = '\0';
> strim(build_date);
> dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
FYI - there's already a fix here waiting for a maintainer to pick it.
https://lore.kernel.org/all/CABXGCsMeAZyNJ-Axt_CUCXgyieWPV3rrcLpWsveMPT8R0YPGnQ@mail.gmail.com/
prev parent reply other threads:[~2025-12-17 22:28 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-17 22:26 [PATCH] wifi: mt76: connac: fix out of bounds read in mt76_connac2_load_patch() Bert Karwatzki
2025-12-17 22:28 ` Mario Limonciello [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8de4b48d-1e25-4334-8afb-1b5d279fb483@kernel.org \
--to=superm1@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-next@vger$(echo .)kernel.org \
--cc=linux-wireless@vger$(echo .)kernel.org \
--cc=nbd@nbd$(echo .)name \
--cc=spasswolf@web$(echo .)de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox