[PATCH] wifi: mt76: mt7921: skip CLC records the driver does not know

[Junjie Cao]

mt7921_load_clc() fails the whole firmware load when a CLC record
carries an idx beyond phy->clc[].  Record types are added by firmware
over time: MT7922 firmware 20260724 (linux-firmware 20260810) ships a
record with idx 3, the slot commit 9b80bd9cab40 ("wifi: mt76: mt7921: add
regulatory wiphy self manager support") assigns to MT792x_CLC_REGD.  A
driver without that entry now gets -EINVAL from mt7921_run_firmware()
and the device never registers.  Every stable branch the validation
commit is backported to has a three-entry phy->clc[], so this firmware
takes MT7922 Wi-Fi down there; before the validation the same record was
written past phy->clc[] into chip_cap instead (UBSAN report in [1]).

Keep the length checks and skip unknown record types, as
mt7925_load_clc() already does.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2515420

Fixes: 9417c5818a01 ("wifi: mt76: mt7921: validate CLC firmware records")
Cc: stable at vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao at intel.com>
---
Greg: 9417c5818a01 carries a 2022 Fixes: tag and will be picked for
every stable series with a three-entry phy->clc[]; on its own it turns
the current MT7922 firmware into a probe failure there. Please take the
two together or hold the earlier one until this is in.

 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index a118a301564c..264f7dbdfa78 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -483,12 +483,15 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
 
 		clc = (const struct mt7921_clc *)(clc_base + offset);
 		clc_len = le32_to_cpu(clc->len);
-		if (clc_len < sizeof(*clc) || clc_len > len - offset ||
-		    clc->idx >= ARRAY_SIZE(phy->clc)) {
+		if (clc_len < sizeof(*clc) || clc_len > len - offset) {
 			ret = -EINVAL;
 			goto out;
 		}
 
+		/* record type newer than this driver */
+		if (clc->idx >= ARRAY_SIZE(phy->clc))
+			continue;
+
 		/* do not init buf again if chip reset triggered */
 		if (phy->clc[clc->idx])
 			continue;
-- 
2.43.0