[PATCH mt76-next 07/11] wifi: mt76: mt7996: validate the RAM firmware region table

[Felix Fietkau <nbd@nbd.name>]

__mt7996_load_ram() only checks that the firmware image holds the
trailer. mt7996_mcu_send_ram_firmware() then walks the region table and
sends each region without checking either against the image size. A
malformed image makes the driver read past the image and send that data
to the device.

Reject the image with mt76_connac2_fw_check(), like the connac2 RAM
loader. The mt7996 trailer and region layouts match the connac2 ones.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 590931207d79..d2d4253e2ccd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -3576,7 +3576,7 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
 	if (ret)
 		return ret;
 
-	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
+	if (mt76_connac2_fw_check(fw, NULL)) {
 		dev_err(dev->mt76.dev, "Invalid firmware\n");
 		ret = -EINVAL;
 		goto out;
-- 
2.47.3