gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7996: validate default EEPROM firmware size

Browse Source 
The default EEPROM firmware is parsed and copied as a full EEPROM
without checking its length. A truncated file can make the driver
read beyond the firmware buffer during variant validation or the
fallback copy.

Reject files shorter than MT7996_EEPROM_SIZE before parsing or
copying the firmware.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: [email protected]
Signed-off-by: Laxman Acharya Padhya <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Laxman Acharya Padhya
2026-07-21 12:38:45 +02:00
committed by Felix Fietkau
parent 6ff6004fdb
commit 3eb3ab6b43
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7996/eeprom.c
+6
View File
@@ -150,6 +150,12 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
goto out; goto out;
} }
if (fw->size < MT7996_EEPROM_SIZE) {
dev_err(dev->mt76.dev, "Invalid default bin size\n");
ret = -EINVAL;
goto out;
}
if (!use_default && mt7996_eeprom_variant_valid(dev, fw->data)) if (!use_default && mt7996_eeprom_variant_valid(dev, fw->data))
goto out; goto out;