Felix Fietkau 041c5d4c41 wifi: mt76: mt7915: check default EEPROM firmware size before copying ...

mt7915_eeprom_load_default() copied mt7915_eeprom_size() bytes from the
firmware blob after only checking that it was non-NULL. A truncated
default bin caused an out-of-bounds read past the firmware buffer into
the EEPROM image. Reject a blob smaller than the EEPROM size.

Fixes: beed8bea8d74 ("mt76: mt7915: add mt7916 calibrated data support")
Signed-off-by: Felix Fietkau <[email protected]>

2026-08-01 17:46:20 +02:00

..

coredump.c

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

coredump.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

debugfs.c

wifi: mt76: mt7915: simplify mt7915_sys_recovery_set()

2026-07-30 10:14:20 +02:00

dma.c

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

eeprom.c

wifi: mt76: mt7915: check default EEPROM firmware size before copying

2026-08-01 17:46:20 +02:00

eeprom.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

init.c

wifi: mt76: cancel reset and rc work on device unregister

2026-07-24 14:45:39 +02:00

Kconfig

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

mac.c

mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang

2026-07-24 14:45:39 +02:00

mac.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

main.c

wifi: mt76: mt7915: unwind state on add_interface failure

2026-07-24 14:45:39 +02:00

Makefile

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

mcu.c

wifi: mt76: mt7915: bound EEPROM access event before copying

2026-08-01 17:46:20 +02:00

mcu.h

wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields

2026-07-24 14:45:39 +02:00

mmio.c

wifi: mt76: mt7915: handle MCU PS sync events

2026-05-07 08:39:05 +00:00

mt7915.h

mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang

2026-07-24 14:45:39 +02:00

pci.c

wifi: mt76: mt7915: fix double hif2 init on the non-WED path

2026-08-01 17:46:20 +02:00

regs.h

mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang

2026-07-24 14:45:39 +02:00

soc.c

wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie

2026-07-22 10:51:13 +02:00

testmode.c

wifi: mt76: mt7915: add bf backoff limit table support

2025-10-13 12:49:20 +02:00

testmode.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00