linux/drivers/net/wireless/mediatek
Lu Huang 52f6a065e0 wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
When the eFuse block covering MT7976C_EFUSE_OFFSET is invalid,
mt7996_mcu_get_eeprom() returns -EINVAL without writing buf, but
mt7996_variant_fem_init() tolerates -EINVAL and keeps running, so
buf[idx] == 0xc reads uninitialized stack memory.  A stale 0x0c byte
misclassifies a 0x7976 aDie as 7976C, selects MT7996_FEM_INT and the
wrong default EEPROM, overriding valid calibration data.  Only consult
the eFuse byte when the read succeeded; with an invalid eFuse, fall
back to the three explicit aDie version checks.

Fixes: e8cb33ad54 ("wifi: mt76: mt7996: add support for more variants")
Cc: stable@vger.kernel.org
Signed-off-by: Lu Huang <huanglu@kylinos.cn>
Link: https://patch.msgid.link/20260930085435.1424493-1-huanglu@kylinos.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-06 11:50:52 +02:00
..
mt76 wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init() 2026-10-06 11:50:52 +02:00
mt7601u wifi: mt7601u: drop redundant device reference 2026-06-09 10:15:20 +00:00
Kconfig
Makefile