[patch] wifi: mt76: mt7925: fix incorrect TLV length in CLC command

[Sean Wang]

On Wed, Feb 25, 2026 at 3:48 AM Quan Zhou <quan.zhou at mediatek.com> wrote:
>
> The previous implementation of __mt7925_mcu_set_clc() set the TLV length
> field (.len) incorrectly during CLC command construction. The length was
> initialized as sizeof(req) - 4, regardless of the actual segment length.
> This could cause the WiFi firmware to misinterpret the command payload,
> resulting in command execution errors.
>
> This patch moves the TLV length assignment to after the segment is
> selected, and sets .len to sizeof(req) + seg->len - 4, matching the
> actual command content. This ensures the firmware receives the
> correct TLV length and parses the command properly.
>
> Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
> Cc: stable at vger.kernel.org
> Signed-off-by: Quan Zhou <quan.zhou at mediatek.com>
> ---
>  drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> index 1379bf6a26b5..abcdd0e0b3b5 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> @@ -3380,7 +3380,6 @@ __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
>                 u8 rsvd[64];
>         } __packed req = {
>                 .tag = cpu_to_le16(0x3),
> -               .len = cpu_to_le16(sizeof(req) - 4),
>
>                 .idx = idx,
>                 .env = env_cap,
> @@ -3409,6 +3408,7 @@ __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
>                 memcpy(req.type, rule->type, 2);
>
>                 req.size = cpu_to_le16(seg->len);
> +               req.len = cpu_to_le16(sizeof(req) + seg->len - 4);
>                 dev->phy.clc_chan_conf = clc->ver == 1 ? 0xff : rule->flag;
>                 skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
>                                            le16_to_cpu(req.size) + sizeof(req),

This looks good. It can help improve stability and avoid firmware
misparsing and MCU timeouts.
Acked-by: Sean Wang <sean.wang at mediatek.com>

> --
> 2.45.2
>
>