From 041c5d4c41064c847d01b28e766f5e1ada54ab6b Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 2 Jul 2026 15:09:01 +0000 Subject: [PATCH] wifi: mt76: mt7915: check default EEPROM firmware size before copying mt7915_eeprom_load_default() copied mt7915_eeprom_size() bytes from the firmware blob after only checking that it was non-NULL. A truncated default bin caused an out-of-bounds read past the firmware buffer into the EEPROM image. Reject a blob smaller than the EEPROM size. Fixes: beed8bea8d74 ("mt76: mt7915: add mt7916 calibrated data support") Signed-off-by: Felix Fietkau --- mt7915/eeprom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c index eb92cbf1..69a0bee4 100644 --- a/mt7915/eeprom.c +++ b/mt7915/eeprom.c @@ -111,6 +111,12 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev) goto out; } + if (fw->size < mt7915_eeprom_size(dev)) { + dev_err(dev->mt76.dev, "Invalid default bin size\n"); + ret = -EINVAL; + goto out; + } + memcpy(eeprom, fw->data, mt7915_eeprom_size(dev)); dev->flash_mode = true;