[PATCH mt76-next 10/11] wifi: mt76: mt7996: validate the ROM patch section table

[Felix Fietkau <nbd@nbd.name>]

mt7996_load_patch() only checks that the patch image holds the header.
The section table after the header, and the offset and length of each
section, come from the image and are not checked against its size. A
malformed image makes the driver read past the image and send that data
to the device.

Reject the image with mt76_connac2_patch_check(), like the connac2 patch
loader. The mt7996 patch header and section layouts match the connac2
ones.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index d2d4253e2ccd..e3420ac523ab 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -3447,7 +3447,7 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
 	if (ret)
 		goto out;
 
-	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
+	if (mt76_connac2_patch_check(fw)) {
 		dev_err(dev->mt76.dev, "Invalid firmware\n");
 		ret = -EINVAL;
 		goto out;
-- 
2.47.3