diff options
| author | Laxman Acharya Padhya <acharyalaxman8848@gmail.com> | 2026-07-13 17:39:12 +0545 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:22:59 +0200 |
| commit | 03b81f015dbb29807ce1ec6d45537d658abdac69 (patch) | |
| tree | 9ca503b45b19d4bd6fef43d9c37ecb626e964929 | |
| parent | 01f2e0da8548f82d704b65b513026cfedc5f8962 (diff) | |
| download | linux-03b81f015dbb29807ce1ec6d45537d658abdac69.tar.gz linux-03b81f015dbb29807ce1ec6d45537d658abdac69.zip | |
wifi: mt76: mt7996: validate default EEPROM firmware size
commit 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f upstream.
The default EEPROM firmware is parsed and copied as a full EEPROM
without checking its length. A truncated file can make the driver
read beyond the firmware buffer during variant validation or the
fallback copy.
Reject files shorter than MT7996_EEPROM_SIZE before parsing or
copying the firmware.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Link: https://patch.msgid.link/20260713115412.67095-1-acharyalaxman8848@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c index da3231c9aa11..11e0a28113a2 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c @@ -148,6 +148,12 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default) goto out; } + if (fw->size < MT7996_EEPROM_SIZE) { + dev_err(dev->mt76.dev, "Invalid default bin size\n"); + ret = -EINVAL; + goto out; + } + if (!use_default && mt7996_eeprom_variant_valid(dev, fw->data)) goto out; |