[PATCH] wifi: mt76: mt7921: validate CLC indices

[Zhao Li]

mt7921_load_clc() indexes phy->clc[] with the index stored in each CLC
record from the firmware image, but does not validate that index before
its first array access.

The equivalent mt7925 parser added the same validation for a potential
array-index out-of-bounds issue and later corrected the comparison from
> to >=. mt7921 never received either change; see the linked commits.

A malformed CLC region can therefore read or write past phy->clc[] while
the driver is starting.

Stop parsing the CLC region when a record has an out-of-range index,
matching the corrected mt7925 parser.

Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support")
Link: https://git.kernel.org/linus/9679ca7326e52282cc923c4d71d81c999cb6cd55
Link: https://git.kernel.org/linus/08fa656c91fd5fdf47ba393795b9c0d1e97539ed
Cc: stable at vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Zhao Li <enderaoelyther at gmail.com>
---
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 25b9437250f7..1c99645b8122 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -467,6 +467,9 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
 		clc = (const struct mt7921_clc *)(clc_base + offset);
 
+		if (clc->idx >= ARRAY_SIZE(phy->clc))
+			break;
+
 		/* do not init buf again if chip reset triggered */
 		if (phy->clc[clc->idx])
 			continue;

base-commit: 4a0bd262df757b25fc4e2a53c947317c119ced4e
-- 
2.50.1 (Apple Git-155)