gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7915: check default EEPROM firmware size before copying

Browse Source 
mt7915_eeprom_load_default() copied mt7915_eeprom_size() bytes from the
firmware blob after only checking that it was non-NULL. A truncated
default bin caused an out-of-bounds read past the firmware buffer into
the EEPROM image. Reject a blob smaller than the EEPROM size.

Fixes: beed8bea8d74 ("mt76: mt7915: add mt7916 calibrated data support")
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2026-08-01 17:46:20 +02:00
parent e308e7430d
commit 041c5d4c41
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7915/eeprom.c
+6
View File
@@ -111,6 +111,12 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
goto out;
}
if (fw->size < mt7915_eeprom_size(dev)) {
dev_err(dev->mt76.dev, "Invalid default bin size\n");
ret = -EINVAL;
goto out;
}
memcpy(eeprom, fw->data, mt7915_eeprom_size(dev));
dev->flash_mode = true;