Felix Fietkau e308e7430d wifi: mt76: mt7915: bound EEPROM access event before copying ...

mt7915_mcu_get_eeprom() copied a 16-byte block out of the firmware
response skb without checking that the response was long enough to hold
it. A short or malformed response could read past the end of the skb.
Reject a response shorter than the response header.

Fixes: 888208d1ccc4 ("wifi: mt76: mt7915: set correct background radar capability")
Signed-off-by: Felix Fietkau <[email protected]>

2026-08-01 17:46:20 +02:00

..

coredump.c

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

coredump.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

debugfs.c

wifi: mt76: mt7915: simplify mt7915_sys_recovery_set()

2026-07-30 10:14:20 +02:00

dma.c

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

eeprom.c

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

eeprom.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

init.c

wifi: mt76: cancel reset and rc work on device unregister

2026-07-24 14:45:39 +02:00

Kconfig

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

mac.c

mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang

2026-07-24 14:45:39 +02:00

mac.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

main.c

wifi: mt76: mt7915: unwind state on add_interface failure

2026-07-24 14:45:39 +02:00

Makefile

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

mcu.c

wifi: mt76: mt7915: bound EEPROM access event before copying

2026-08-01 17:46:20 +02:00

mcu.h

wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields

2026-07-24 14:45:39 +02:00

mmio.c

wifi: mt76: mt7915: handle MCU PS sync events

2026-05-07 08:39:05 +00:00

mt7915.h

mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang

2026-07-24 14:45:39 +02:00

pci.c

wifi: mt76: mt7915: fix double hif2 init on the non-WED path

2026-08-01 17:46:20 +02:00

regs.h

mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang

2026-07-24 14:45:39 +02:00

soc.c

wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie

2026-07-22 10:51:13 +02:00

testmode.c

wifi: mt76: mt7915: add bf backoff limit table support

2025-10-13 12:49:20 +02:00

testmode.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00