[PATCH mt76-next 01/11] wifi: mt76: mt7921: validate CLC event length

[Felix Fietkau <nbd@nbd.name>]

With CLC_CAP_EVT_EN set, __mt7921_mcu_set_clc() reads chan_conf from the
SET_CLC response without checking the response length. A truncated
response causes an out-of-bounds read.

Reject a response that is too short for the CLC info TLV.

Fixes: 4fc8df50fd41 ("wifi: mt76: mt7921: get regulatory information from the clc event")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 89d2c11b97ee..79fead3ccce1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1446,6 +1446,12 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
 		if (ret_skb) {
 			struct mt7921_clc_info_tlv *info;
 
+			if (ret_skb->len < 4 + offsetofend(struct mt7921_clc_info_tlv,
+							   chan_conf)) {
+				dev_kfree_skb(ret_skb);
+				return -EINVAL;
+			}
+
 			info = (struct mt7921_clc_info_tlv *)(ret_skb->data + 4);
 			dev->phy.clc_chan_conf = info->chan_conf;
 			dev_kfree_skb(ret_skb);
-- 
2.47.3