| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20251217222622.8161-1-spasswolf@web.de>
Date: Wed, 17 Dec 2025 23:26:20 +0100
From: Bert Karwatzki <spasswolf@....de>
To: Mario Limonciello <superm1@...nel.org>
Cc: Bert Karwatzki <spasswolf@....de>,
Felix Fietkau <nbd@....name>,
linux-kernel@...r.kernel.org,
linux-wireless@...r.kernel.org,
linux-next@...r.kernel.org
Subject: [PATCH] wifi: mt76: connac: fix out of bounds read in mt76_connac2_load_patch()
As sizeof(hdr->build_date) is 16 we reading 17 bytes (sizeof(build_date))
result in the following error:
[ T378] ------------[ cut here ]------------
[ T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16
[ T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378
[...]
[ T378] mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
[ T378] mt792x_load_firmware+0x31/0x140 [mt792x_lib]
Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
Signed-off-by: Bert Karwatzki <spasswolf@....de>
---
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
index ea99167765b0..aca3d7870dce 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
@@ -3125,7 +3125,7 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
}
hdr = (const void *)fw->data;
- strscpy(build_date, hdr->build_date, sizeof(build_date));
+ strscpy(build_date, hdr->build_date, sizeof(hdr->build_date));
build_date[16] = '\0';
strim(build_date);
dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
--
2.47.3
In linux-next-20251217 I noticed the following error during boot:
[ T378] ------------[ cut here ]------------
[ T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16
[ T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378
[ T378] Modules linked in: mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics configfs efi_pstore efivarfs autofs4 ext4 mbcache jbd2 amdgpu usbhid drm_client_lib i2c_algo_bit drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_buddy xhci_pci drm_panel_backlight_quirks gpu_sched amdxcp xhci_hcd hid_sensor_hub drm_display_helper mfd_core hid_multitouch hid_generic psmouse usbcore nvme drm_kms_helper i2c_hid_acpi amd_sfh i2c_hid hid serio_raw nvme_core cec i2c_piix4 r8169 i2c_smbus usb_common crc16 i2c_designware_platform i2c_designware_core
[ T378] CPU: 15 UID: 0 PID: 378 Comm: kworker/15:1 Not tainted 6.19.0-rc1-next-20251217-master #262 PREEMPT_{RT,(full)}
[ T378] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-158L, BIOS E158LAMS.10F 11/11/2024
[ T378] Workqueue: events mt7921_init_work [mt7921_common]
[ T378] RIP: 0010:__fortify_report+0x3e/0x50
[ T378] Code: 39 c8 48 0f 47 c1 83 e7 01 48 c7 c1 29 ac 54 95 48 8b 34 c5 e0 d5 26 95 48 c7 c0 8c 8f 54 95 48 0f 44 c8 48 8d 3d 42 ba c7 00 <67> 48 0f b9 3a e9 d3 aa a5 ff 0f 1f 84 00 00 00 00 00 f3 0f 1e fa
[ T378] RSP: 0018:ffffb015823a7d18 EFLAGS: 00010246
[ T378] RAX: ffffffff95548f8c RBX: 0000000000000000 RCX: ffffffff95548f8c
[ T378] RDX: 0000000000000011 RSI: ffffffff955319d6 RDI: ffffffff95925070
[ T378] RBP: ffff8ebf90f22560 R08: 0000000000000010 R09: ffffb01581f8d000
[ T378] R10: ffff8ebf80042700 R11: ffff8ec23a7e5930 R12: 0000000000000000
[ T378] R13: ffffb01581f8d000 R14: 0000000000001000 R15: 0000000000000000
[ T378] FS: 0000000000000000(0000) GS:ffff8ec2a49de000(0000) knlGS:0000000000000000
[ T378] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ T378] CR2: 00007f861de85114 CR3: 0000000025222000 CR4: 0000000000750ef0
[ T378] PKRU: 55555554
[ T378] Call Trace:
[ T378] <TASK>
[ T378] __fortify_panic+0xd/0xf
[ T378] mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
[ T378] mt792x_load_firmware+0x31/0x140 [mt792x_lib]
[ T378] mt7921_run_firmware+0x27/0x490 [mt7921_common]
[ T378] ? srso_alias_return_thunk+0x5/0xfbef5
[ T378] ? srso_alias_return_thunk+0x5/0xfbef5
[ T378] ? ____mt76_poll_msec+0x70/0xb0 [mt76]
[ T378] mt7921e_mcu_init+0x47/0x75 [mt7921e]
[ T378] mt7921_init_work+0x4c/0x190 [mt7921_common]
[ T378] process_one_work+0x17b/0x290
[ T378] worker_thread+0x17d/0x2e0
[ T378] ? bh_worker+0x1c0/0x1c0
[ T378] kthread+0xe9/0x1e0
[ T378] ? kthreads_online_cpu+0x100/0x100
[ T378] ? kthreads_online_cpu+0x100/0x100
[ T378] ret_from_fork+0x23e/0x270
[ T378] ? kthreads_online_cpu+0x100/0x100
[ T378] ret_from_fork_asm+0x11/0x20
[ T378] </TASK>
[ T378] ---[ end trace 0000000000000000 ]---
[ T378] ------------[ cut here ]------------
[ T378] kernel BUG at lib/string_helpers.c:1044!
[ T378] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ T378] CPU: 15 UID: 0 PID: 378 Comm: kworker/15:1 Tainted: G W 6.19.0-rc1-next-20251217-master #262 PREEMPT_{RT,(full)}
[ T378] Tainted: [W]=WARN
[ T378] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-158L, BIOS E158LAMS.10F 11/11/2024
[ T378] Workqueue: events mt7921_init_work [mt7921_common]
[ T378] RIP: 0010:__fortify_panic+0xd/0xf
[ T378] Code: d6 e8 57 e6 fe ff 48 89 df e8 7f 5c 23 00 e9 21 80 48 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 40 0f b6 ff e8 53 c1 48 00 <0f> 0b 48 8b 54 24 08 48 8b 34 24 4c 8d 44 24 1d 4c 89 e9 48 c7 c7
[ T378] RSP: 0018:ffffb015823a7d20 EFLAGS: 00010246
[ T378] RAX: ffffffff95548f8c RBX: 0000000000000000 RCX: ffffffff95548f8c
[ T378] RDX: 0000000000000011 RSI: ffffffff955319d6 RDI: ffffffff95925070
[ T378] RBP: ffff8ebf90f22560 R08: 0000000000000010 R09: ffffb01581f8d000
[ T378] R10: ffff8ebf80042700 R11: ffff8ec23a7e5930 R12: 0000000000000000
[ T378] R13: ffffb01581f8d000 R14: 0000000000001000 R15: 0000000000000000
[ T378] FS: 0000000000000000(0000) GS:ffff8ec2a49de000(0000) knlGS:0000000000000000
[ T378] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ T378] CR2: 00007f861de85114 CR3: 0000000025222000 CR4: 0000000000750ef0
[ T378] PKRU: 55555554
[ T378] Call Trace:
[ T378] <TASK>
[ T378] mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
[ T378] mt792x_load_firmware+0x31/0x140 [mt792x_lib]
[ T378] mt7921_run_firmware+0x27/0x490 [mt7921_common]
[ T378] ? srso_alias_return_thunk+0x5/0xfbef5
[ T378] ? srso_alias_return_thunk+0x5/0xfbef5
[ T378] ? ____mt76_poll_msec+0x70/0xb0 [mt76]
[ T378] mt7921e_mcu_init+0x47/0x75 [mt7921e]
[ T378] mt7921_init_work+0x4c/0x190 [mt7921_common]
[ T378] process_one_work+0x17b/0x290
[ T378] worker_thread+0x17d/0x2e0
[ T378] ? bh_worker+0x1c0/0x1c0
[ T378] kthread+0xe9/0x1e0
[ T378] ? kthreads_online_cpu+0x100/0x100
[ T378] ? kthreads_online_cpu+0x100/0x100
[ T378] ret_from_fork+0x23e/0x270
[ T378] ? kthreads_online_cpu+0x100/0x100
[ T378] ret_from_fork_asm+0x11/0x20
[ T378] </TASK>
[ T378] Modules linked in: mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics configfs efi_pstore efivarfs autofs4 ext4 mbcache jbd2 amdgpu usbhid drm_client_lib i2c_algo_bit drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_buddy xhci_pci drm_panel_backlight_quirks gpu_sched amdxcp xhci_hcd hid_sensor_hub drm_display_helper mfd_core hid_multitouch hid_generic psmouse usbcore nvme drm_kms_helper i2c_hid_acpi amd_sfh i2c_hid hid serio_raw nvme_core cec i2c_piix4 r8169 i2c_smbus usb_common crc16 i2c_designware_platform i2c_designware_core
[ T378] ---[ end trace 0000000000000000 ]---
The result of this is that my wireless card doesn't work. The patch
above fixes the issue.
Bert Karwatzki
Powered by blists - more mailing lists