gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

Browse Source 
mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's
dev->mt76.eeprom.data buffer at the offset reported by the MCU response
(res->addr, a device-controlled __le32) without checking it against the
buffer size. A malicious or malfunctioning device can report an arbitrary
address and drive a 16-byte out-of-bounds write past eeprom.data.

Reject a response whose address would place the copy outside eeprom.data
before deriving the destination pointer. Devices that echo the requested
in-bounds offset are unaffected.

Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Cc: [email protected]
Signed-off-by: Bryam Vargas <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Bryam Vargas
2026-07-21 12:39:16 +02:00
committed by Felix Fietkau
parent 75268f2eaa
commit a1d83aad6c
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7915/mcu.c
+9 -2
View File
@@ -2943,8 +2943,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
return ret;
res = (struct mt7915_mcu_eeprom_info *)skb->data;
if (!buf)
buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
if (!buf) {
u32 addr = le32_to_cpu(res->addr);
if (addr > dev->mt76.eeprom.size - MT7915_EEPROM_BLOCK_SIZE) {
dev_kfree_skb(skb);
return -EINVAL;
}
buf = dev->mt76.eeprom.data + addr;
}
memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
dev_kfree_skb(skb);