Commit 82a980f8 authored by Shayne Chen's avatar Shayne Chen Committed by Felix Fietkau
Browse files

mt76: mt7915: fix potential overflow of eeprom page index 



If total eeprom size is divisible by per-page size, the i in for loop
will exceed max page index, which happens in our newer chipset.

Fixes: 26f18380 ("mt76: mt7915: add support for flash mode")
Signed-off-by: default avatarBo Jiao <bo.jiao@mediatek.com>
Signed-off-by: default avatarShayne Chen <shayne.chen@mediatek.com>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 7780ba75

drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

+5 −5
Original line number Diff line number Diff line
@@ -3244,20 +3244,20 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd) 


static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)

{

#define TOTAL_PAGE_MASK		GENMASK(7, 5)

#define MAX_PAGE_IDX_MASK	GENMASK(7, 5)

#define PAGE_IDX_MASK		GENMASK(4, 2)

#define PER_PAGE_SIZE		0x400

	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };

	u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;

	u8 total = DIV_ROUND_UP(MT7915_EEPROM_SIZE, PER_PAGE_SIZE);

	u8 *eep = (u8 *)dev->mt76.eeprom.data;

	int eep_len;

	int i;



	for (i = 0; i <= total; i++, eep += eep_len) {

	for (i = 0; i < total; i++, eep += eep_len) {

		struct sk_buff *skb;

		int ret;



		if (i == total)

		if (i == total - 1 && !!(MT7915_EEPROM_SIZE % PER_PAGE_SIZE))

			eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;

		else

			eep_len = PER_PAGE_SIZE;
@@ -3267,7 +3267,7 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev) 
		if (!skb)

			return -ENOMEM;



		req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |

		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |

			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;

		req.len = cpu_to_le16(eep_len);