From 3eb3ab6b43f2e8108cdb0bea7891c900aabc5eed Mon Sep 17 00:00:00 2001 From: Laxman Acharya Padhya Date: Mon, 13 Jul 2026 17:39:12 +0545 Subject: [PATCH] wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy. Reject files shorter than MT7996_EEPROM_SIZE before parsing or copying the firmware. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya Link: https://patch.msgid.link/20260713115412.67095-1-acharyalaxman8848@gmail.com Signed-off-by: Felix Fietkau --- mt7996/eeprom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c index ac05f7d7..ec33521d 100644 --- a/mt7996/eeprom.c +++ b/mt7996/eeprom.c @@ -150,6 +150,12 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default) goto out; } + if (fw->size < MT7996_EEPROM_SIZE) { + dev_err(dev->mt76.dev, "Invalid default bin size\n"); + ret = -EINVAL; + goto out; + } + if (!use_default && mt7996_eeprom_variant_valid(dev, fw->data)) goto out;