FAILED: patch "[PATCH] wifi: mt76: mt7915: bound the device EEPROM address before" failed to apply to 5.10-stable tree

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 44b5adfe49499f53002737f5fe81d608c08122fc
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090458-lion-librarian-5f33@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 44b5adfe49499f53002737f5fe81d608c08122fc Mon Sep 17 00:00:00 2001
From: Bryam Vargas <[email protected]>
Date: Thu, 25 Jun 2026 07:10:26 -0500
Subject: [PATCH] wifi: mt76: mt7915: bound the device EEPROM address before
the EFUSE copy

mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data.

Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.

index e8fe86f93309..bbb2fedacb25 100644
@@ -2917,8 +2917,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
 		return ret;
 
 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
-	if (!buf)
-		buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
+	if (!buf) {
+		u32 addr = le32_to_cpu(res->addr);
+
+		if (addr > dev->mt76.eeprom.size - MT7915_EEPROM_BLOCK_SIZE) {
+			dev_kfree_skb(skb);
+			return -EINVAL;
+		}
+		buf = dev->mt76.eeprom.data + addr;
+	}
 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
 
 	dev_kfree_skb(skb);

From: Xing Song <[email protected]>

[ Upstream commit 4e58ef4b6d727abdb071f7799aef763f8d6f2ad8 ]

The radar detctor is used for dfs channel. So it will start after switching to dfs channel and will stop after leaving. The TX will be blocked if radar detctor isn't stopped in non-dfs channel.

This patch resets the dfs state to indicate the radar detector needs to be stopped.

Stable-dep-of: 44b5adfe4949 ("wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy")

---
 drivers/net/wireless/mediatek/mt76/mt7615/main.c | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

index defa207f53d6f..f71889ff49741 100644
@@ -277,7 +277,8 @@ static void mt7615_init_dfs_state(struct mt7615_phy *phy)
 	if (hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
 		return;
 
-	if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR))
+	if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
+	    !(mphy->chandef.chan->flags & IEEE80211_CHAN_RADAR))
 		return;
 
 	if (mphy->chandef.chan->center_freq == chandef->chan->center_freq &&

index 6495d2edf7dc4..edab58fdc13e5 100644
@@ -212,7 +212,8 @@ static void mt7915_init_dfs_state(struct mt7915_phy *phy)
 	if (hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
 		return;
 
-	if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR))
+	if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
+	    !(mphy->chandef.chan->flags & IEEE80211_CHAN_RADAR))
 		return;
 
 	if (mphy->chandef.chan->center_freq == chandef->chan->center_freq &&

2.53.0

From: StanleyYP Wang <[email protected]>

[ Upstream commit 888208d1ccc41bebe97744445787183b17bb3ea4 ]

Some of the variants do not support background radar, so add a helper to report background radar capability.
For mt7916, only the variant of 5G 2T2R + 1R supports background radar.

Backport notes for 5.10:
Retain the optional EEPROM read buffer and update the existing caller. Omit the background radar capability helper, feature advertisement, debugfs check and newer-chip EEPROM field: those facilities are absent from this tree and are not needed by the target fix.

The 5.10 MCU path predates mt76_mcu_send_and_get_msg() and still copies EFUSE data in mt7915_mcu_parse_eeprom(). Move that copy into the existing mt7915_mcu_get_eeprom(), removing the old parser. Extend the existing response wait function to hand a successful response skb to the EEPROM caller; preserve freeing of unmatched and unclaimed responses, the MCU mutex, sequence matching and timeout. Use the existing low-level send function and define the 16-byte EEPROM block size. No functions are added.

This prepares the original copy site and optional-buffer branch expected by 44b5adfe49499f53002737f5fe81d608c08122fc so its bounds check applies unchanged. The security fix itself remains in the target commit.

[ sashal: Reduced backport -- upstream 888208d1ccc41 touches 6 file(s), this
backport carries 3. Not backported here:
drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h drivers/net/wireless/mediatek/mt76/mt7915/init.c
This note is generated from the file lists only; see the resolution record for the reasoning. ]

Stable-dep-of: 44b5adfe4949 ("wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy")

---
 .../wireless/mediatek/mt76/mt7915/eeprom.c    |  2 +-
 .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 63 +++++++++++--------
 .../wireless/mediatek/mt76/mt7915/mt7915.h    |  3 +-
 3 files changed, 39 insertions(+), 29 deletions(-)

index 5f6c527611f20..1035393859864 100644
@@ -14,7 +14,7 @@ u32 mt7915_eeprom_read(struct mt7915_dev *dev, u32 offset)
 	u8 *data = dev->mt76.eeprom.data;
 
 	if (!mt7915_efuse_valid(data[offset]))
-		mt7915_mcu_get_eeprom(dev, offset);
+		mt7915_mcu_get_eeprom(dev, offset, NULL);
 
 	return data[offset];
 }

index c84110e34ede1..21ce01a143aaa 100644
@@ -31,6 +31,7 @@
 #define MT7915_ROM_PATCH		"mediatek/mt7915_rom_patch.bin"
 
 #define MT7915_EEPROM_SIZE		3584
+#define MT7915_EEPROM_BLOCK_SIZE		16
 #define MT7915_TOKEN_SIZE		8192
 
 #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */

@@ -311,7 +312,7 @@ int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif);
 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
 			      struct ieee80211_sta *sta, u32 rate);
 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev);
-int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
+int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf);
 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
 		       bool hdr_trans);
 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable);

2.53.0

From: Bryam Vargas <[email protected]>

[ Upstream commit 44b5adfe49499f53002737f5fe81d608c08122fc ]

mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data.

Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.

---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

index b123ca720a307..397ef111a5c8f 100644
@@ -3247,8 +3247,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
 		return ret;
 
 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
-	if (!buf)
-		buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
+	if (!buf) {
+		u32 addr = le32_to_cpu(res->addr);
+
+		if (addr > dev->mt76.eeprom.size - MT7915_EEPROM_BLOCK_SIZE) {
+			dev_kfree_skb(skb);
+			return -EINVAL;
+		}
+		buf = dev->mt76.eeprom.data + addr;
+	}
 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
 
 	dev_kfree_skb(skb);

2.53.0