diff options
| author | Laxman Acharya Padhya <acharyalaxman8848@gmail.com> | 2026-07-13 17:39:12 +0545 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:37:27 +0200 |
| commit | 7074ec3769820302f1ccf8794a40a6582153b820 (patch) | |
| tree | 695dee46b60cc1d0454c447f5aa727ebff093a27 | |
| parent | b754d3a6d44c53d9853eba374d8a7ef279a9d00a (diff) | |
| download | linux-7074ec3769820302f1ccf8794a40a6582153b820.tar.gz linux-7074ec3769820302f1ccf8794a40a6582153b820.zip | |
wifi: mt76: mt7996: validate default EEPROM firmware size
commit 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f upstream.
The default EEPROM firmware is parsed and copied as a full EEPROM
without checking its length. A truncated file can make the driver
read beyond the firmware buffer during variant validation or the
fallback copy.
Reject files shorter than MT7996_EEPROM_SIZE before parsing or
copying the firmware.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Link: https://patch.msgid.link/20260713115412.67095-1-acharyalaxman8848@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c index ac05f7d75d63..ec33521db564 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c @@ -150,6 +150,12 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default) goto out; } + if (fw->size < MT7996_EEPROM_SIZE) { + dev_err(dev->mt76.dev, "Invalid default bin size\n"); + ret = -EINVAL; + goto out; + } + if (!use_default && mt7996_eeprom_variant_valid(dev, fw->data)) goto out; |