[PATCH] wifi: mt76: mt7921: skip unknown CLC firmware records

[Thorsten Leemhuis]

On 8/16/26 19:48, Laxman Acharya Padhya wrote:
> Treat an out-of-range CLC index as newer firmware rather than a
> malformed image. linux-firmware 20260810 ships MT7922 records with
> idx 3, and rejecting them made mt7921e fail to probe.
> 
> Keep the record-length checks, and report those as errors so a
> truncated table is visible instead of a silent retry loop.

For the record: Linus pulled this directly from the list into mainline
yesterday after I pointed to this patch in a small regression report. I
did that, as I had seen multiple people reporting a regression who
confirmed that this patch fixed things for them.

Bypassing subsystems like this has obvious downsides and risks; hence,
if that got something on the wrong track, please speak up -- or ideally
send patches to set things straight again in mainline.

https://git.kernel.org/torvalds/c/1a296bfd3e775e515233f746218824fc7dd5ff16
/ 1a296bfd3e775e ("wifi: mt76: mt7921: skip unknown CLC firmware
records") [v7.3-rc3]

Ciao, Thorsten
> Fixes: 9417c5818a01 ("wifi: mt76: mt7921: validate CLC firmware records")
> Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov at gmail.com>
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848 at gmail.com>
> ---
>  drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
> index a118a301564c..40546005c743 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
> @@ -477,18 +477,23 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
>  
>  	for (offset = 0; offset < len; offset += clc_len) {
>  		if (len - offset < sizeof(*clc)) {
> +			dev_err(mdev->dev, "Invalid CLC record\n");
>  			ret = -EINVAL;
>  			goto out;
>  		}
>  
>  		clc = (const struct mt7921_clc *)(clc_base + offset);
>  		clc_len = le32_to_cpu(clc->len);
> -		if (clc_len < sizeof(*clc) || clc_len > len - offset ||
> -		    clc->idx >= ARRAY_SIZE(phy->clc)) {
> +		if (clc_len < sizeof(*clc) || clc_len > len - offset) {
> +			dev_err(mdev->dev, "Invalid CLC record\n");
>  			ret = -EINVAL;
>  			goto out;
>  		}
>  
> +		/* Newer firmware may add records this driver does not use yet */
> +		if (clc->idx >= ARRAY_SIZE(phy->clc))
> +			continue;
> +
>  		/* do not init buf again if chip reset triggered */
>  		if (phy->clc[clc->idx])
>  			continue;