linux-kernel - Re: [PATCH] wifi: mt76: connac: fix out of bounds read in mt76_connac2_load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8de4b48d-1e25-4334-8afb-1b5d279fb483@kernel.org>
Date: Wed, 17 Dec 2025 16:28:18 -0600
From: Mario Limonciello <superm1@...nel.org>
To: Bert Karwatzki <spasswolf@....de>
Cc: Felix Fietkau <nbd@....name>, linux-kernel@...r.kernel.org,
 linux-wireless@...r.kernel.org, linux-next@...r.kernel.org
Subject: Re: [PATCH] wifi: mt76: connac: fix out of bounds read in
 mt76_connac2_load_patch()

On 12/17/25 4:26 PM, Bert Karwatzki wrote:
> As sizeof(hdr->build_date) is 16 we reading 17 bytes (sizeof(build_date))
> result in the following error:
> 
> [    T378] ------------[ cut here ]------------
> [    T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16
> [    T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378
> [...]
> [    T378]  mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
> [    T378]  mt792x_load_firmware+0x31/0x140 [mt792x_lib]
> 
> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
> 
> Signed-off-by: Bert Karwatzki <spasswolf@....de>
> ---
>   drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> index ea99167765b0..aca3d7870dce 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> @@ -3125,7 +3125,7 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
>   	}
>   
>   	hdr = (const void *)fw->data;
> -	strscpy(build_date, hdr->build_date, sizeof(build_date));
> +	strscpy(build_date, hdr->build_date, sizeof(hdr->build_date));
>   	build_date[16] = '\0';
>   	strim(build_date);
>   	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",

FYI - there's already a fix here waiting for a maintainer to pick it.

https://lore.kernel.org/all/CABXGCsMeAZyNJ-Axt_CUCXgyieWPV3rrcLpWsveMPT8R0YPGnQ@mail.gmail.com/