From nobody Fri Oct 2 13:03:58 2026 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D323D3859C2 for ; Fri, 31 Jul 2026 07:12:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481930; cv=none; b=IiJ+f+wfSlRoaGLd/16pLWv0tZSvgxF3ZhGLQ3Ds1lzUu0Phr4nJNVM9a0wI4v0CrXpkwxe4LNiIDKv3Y8uURPrGW5rYR/EbowJmnjLoqINJq2toOplpnlMhzmhQXzAr6QzJ1X/Uu1LEBmCWZ/mXCvcdrf/YnGpTGyCIE2HXd+M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481930; c=relaxed/simple; bh=zQi9ubKcOArEPKQUo2BWV5Pccb8fFbLU0DSqAsWQMb0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fNmPif/b5TqPrueYpW9bwWyfhLVrR9REchEL83+8totT38G9Myw3L1tvV7XGxt4esODUD0uR/Qonu1JTkwWAuTM4pTx4+4FNr3nXGNJYZG4uvuolV6FYd3Zpw23EG7UTw9l1+HH3s4mqApDmdmA3WxogLOsNOncoLcARx6NUe6M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EalirIWE; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EalirIWE" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c9cf07d2df6so495687a12.2 for ; Fri, 31 Jul 2026 00:12:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785481919; x=1786086719; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=p/zSUWBhbluccRh5Y+3PaEaBGuhqo6tGCiQ6G7WtFxk=; b=EalirIWEPJ09Cebu3MNRI8bkiwl2XsvrhhhX4vePKd2+6FLrOX3aTMQX3jVLuRjvgk BcX4ai9Z2wnmmlKmD/M27Xg3LYgXd+O+ZF+/W8DaJOo0TIKB1fAmmfM/9CcvVrJl2TA3 RB+nEGbS+I77Aa0tvHAgdJktARzCN+MAzSQ4Dc3mIwQYMSbvCw8oqEh2SeY3YiwUmkRJ XmnWWrLkUA8zAyqGZEiFYclpg3y9Xb92EV56kQva/b6fUyR/mJcXfjFaKVpAe63MkijH ALkC7knYR4gavBnazUG3eQQryYTJJGZQKWmaPvjl+U+oipmfvCaBEiIwRfYaukcDS4zE No7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785481919; x=1786086719; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=p/zSUWBhbluccRh5Y+3PaEaBGuhqo6tGCiQ6G7WtFxk=; b=h3meTSA1ipTxyi0p/unUWhQJxUfkhYSDIEf9nxiof8d0K8U5ZuBOvBBw0zkMm9YZRb sAYp11FFr8OyBaqXH03OcKVU7q4OJQ4q72jeIS0eORv2oVPu84fL51gwBQL/crgDSaJu k/V/KLeMC9hgr3KWQRgtNUj5RjrAYurtOW3pKN94uKGkC+g8QIoq3DGgW/Nrr90vksEZ VxM1IySELA/s2XjSzdf/plaS3Zk9HXWMRJWlrwES7+ALodTyntp6nWRabWD+IBN+SxHy GpD3JM++enrCKkHr5E+dj0rkjx9Ka0jxdEwT5LjGszcXtuDvdSmta0S4vWzlyDT9Jjdc bc7A== X-Forwarded-Encrypted: i=1; AHgh+Rq+QS5cYCr+nGkS14WXpCBK459jdN3MF5+aXe7ijicL6w8hG6Ysr31xEgoz/8SorP3rBM+7SxF1cYPsi+A=@vger.kernel.org X-Gm-Message-State: AOJu0YwmUfEKtJrxuxtC3spqxYx6JdTxQCG/DSJJLcWcT6mXW4LGzwfd yNR4gWEFnIkSCwfJE3caAvhtOuDXnowzrHwjuN3igqxxc5RWOVWZSJJ8 X-Gm-Gg: AR+sD13bX5dsQR5ZIXX8bBegEr8u36Hy6mRydTlRwv7wq7J7sbu1Y9+NCtacYhIlj6n C4/qzQiXwamd2x8V+FQ+I/QEKlCTjWbfIry7Xo+w+UKjBm+jkDtG8O64F4Yry4ZgROkm9xZbR9H YyxgnKBcsdRq6byFt2yAYY78Rh4JnMycVew5iZXn/WDceERM5VaUKdh0cnYTHigFuPWeRlZ6pjF M1cl6l8iPV2bbEvxQip+7IOydZKOhwpAs45fWvGnrjJeTZnof+XMoyAeKYpGoO+ZM/wRbGTgZOc yV2095eIsFR3a6vBYld0Q3CoiT4k91yO/HGiIZbhDr5RdPtTzTBvP8sOoy4ukk/OC711xGYMReO FOvw8udilK6tVMYa0ouDPXDUhOPWGB7I7UqExyuy+gb3sUfhuuVPVV9CPq17SQBclP7SAHDkWWT 0v1vK+ey5p2Y8J9rHk/pKhW7clO5Cyn0nXZEBbN1UabJfSn95RQpCn3MAaH30qTSaN0teFXdQTW PxoHRnDL+1QSBdSGrd5WIxWU9M= X-Received: by 2002:a05:6a20:4308:b0:3c3:a1ed:3c36 with SMTP id adf61e73a8af0-3c91b266a96mr892351637.24.1785481918740; Fri, 31 Jul 2026 00:11:58 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([203.208.189.11]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3153dd4f0f0sm2308226eec.2.2026.07.31.00.11.52 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 31 Jul 2026 00:11:58 -0700 (PDT) From: Zhao Li To: Felix Fietkau , Lorenzo Bianconi , Ryder Lee Cc: Shayne Chen , Sean Wang , Matthias Brugger , AngeloGioacchino Del Regno , JB Tsai , Leon Yen , Quan Zhou , Ming Yen Hsieh , Deren Wu , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, stable@vger.kernel.org Subject: [PATCH] wifi: mt76: mt7921: validate CLC indices Date: Fri, 31 Jul 2026 15:11:48 +0800 Message-ID: <20260731071148.74484-1-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mt7921_load_clc() indexes phy->clc[] with the index stored in each CLC record from the firmware image, but does not validate that index before its first array access. The equivalent mt7925 parser added the same validation for a potential array-index out-of-bounds issue and later corrected the comparison from > to >=3D. mt7921 never received either change; see the linked commits. A malformed CLC region can therefore read or write past phy->clc[] while the driver is starting. Stop parsing the CLC region when a record has an out-of-range index, matching the corrected mt7925 parser. Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Contro= l support") Link: https://git.kernel.org/linus/9679ca7326e52282cc923c4d71d81c999cb6cd55 Link: https://git.kernel.org/linus/08fa656c91fd5fdf47ba393795b9c0d1e97539ed Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Zhao Li --- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/= wireless/mediatek/mt76/mt7921/mcu.c index 25b9437250f7..1c99645b8122 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -467,6 +467,9 @@ static int mt7921_load_clc(struct mt792x_dev *dev, cons= t char *fw_name) for (offset =3D 0; offset < len; offset +=3D le32_to_cpu(clc->len)) { clc =3D (const struct mt7921_clc *)(clc_base + offset); =20 + if (clc->idx >=3D ARRAY_SIZE(phy->clc)) + break; + /* do not init buf again if chip reset triggered */ if (phy->clc[clc->idx]) continue; base-commit: 4a0bd262df757b25fc4e2a53c947317c119ced4e --=20 2.50.1 (Apple Git-155)