[PATCH 03/11] wifi: mt76: mt7921: reject malformed TX power responses

[Jiale Yao]

mt7921_get_txpwr_info() only warns when the firmware length differs from
the skb length and then copies the response anyway. It also reads the
length field before ensuring that the response header is present.

Require the complete event and reject a mismatched firmware length
before copying the TX power data.

Fixes: ea29acc97c55 ("mt76: mt7921: add dumping Tx power table")
Signed-off-by: Jiale Yao <yaojiale02 at 163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index ef6660653723..96e5e13d3c47 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1167,8 +1167,17 @@ int mt7921_get_txpwr_info(struct mt792x_dev *dev, struct mt7921_txpwr *txpwr)
 	if (ret)
 		return ret;
 
+	if (skb->len < sizeof(*event)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
+
 	event = (struct mt7921_txpwr_event *)skb->data;
-	WARN_ON(skb->len != le16_to_cpu(event->len));
+	if (skb->len != le16_to_cpu(event->len)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
+
 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
 
 	dev_kfree_skb(skb);
-- 
2.34.1