mt792x_get_offload_capability() and mt7921_load_clc() open-code the
checks of the firmware region table that mt76_connac2_fw_check() now
provides. Use the helper instead.

mt7921_load_clc() now checks every region, not only the regions in front
of the CLC region.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 .../net/wireless/mediatek/mt76/mt7921/mcu.c   | 19 ++-------------
 .../net/wireless/mediatek/mt76/mt792x_core.c  | 23 +++----------------
 2 files changed, 5 insertions(+), 37 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 9b2fa1db7642..a0caa77339ee 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -442,7 +442,7 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
 	struct mt76_dev *mdev = &dev->mt76;
 	struct mt792x_phy *phy = &dev->phy;
 	const struct firmware *fw;
-	size_t clc_len, fw_data_len, len, offset = 0;
+	size_t clc_len, len, offset = 0;
 	int ret, i;
 	u8 *clc_base = NULL, hw_encap = 0;
 
@@ -462,33 +462,18 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
 	if (ret)
 		return ret;
 
-	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
+	if (mt76_connac2_fw_check(fw, NULL)) {
 		dev_err(mdev->dev, "Invalid firmware\n");
 		ret = -EINVAL;
 		goto out;
 	}
 
 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
-	if (hdr->n_region > (fw->size - sizeof(*hdr)) / sizeof(*region)) {
-		dev_err(mdev->dev, "Invalid firmware region table\n");
-		ret = -EINVAL;
-		goto out;
-	}
-	fw_data_len = fw->size - sizeof(*hdr) -
-		      hdr->n_region * sizeof(*region);
-
 	for (i = 0; i < hdr->n_region; i++) {
 		region = (const void *)((const u8 *)hdr -
 					(hdr->n_region - i) * sizeof(*region));
 		len = le32_to_cpu(region->len);
 
-		/* check if we have valid buffer size */
-		if (len > fw_data_len - offset) {
-			dev_err(mdev->dev, "Invalid firmware region\n");
-			ret = -EINVAL;
-			goto out;
-		}
-
 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
 		    region->type == FW_TYPE_CLC) {
 			clc_base = (u8 *)(fw->data + offset);
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index 0eee9c7a2bfd..dbea3c2e626f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -866,38 +866,21 @@ mt792x_get_offload_capability(struct device *dev, const char *fw_wm)
 	const u8 *data, *end, *fw_end;
 	const struct firmware *fw;
 	u8 offload_caps = 0;
-	size_t offset = 0;
-	int ret, i;
+	size_t offset;
+	int ret;
 
 	ret = request_firmware(&fw, fw_wm, dev);
 	if (ret)
 		return ret;
 
-	if (!fw || !fw->data || fw->size < sizeof(*hdr))
+	if (mt76_connac2_fw_check(fw, &offset))
 		goto invalid;
 
 	data = fw->data;
 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
-	if (hdr->n_region > (fw->size - sizeof(*hdr)) /
-			    sizeof(struct mt76_connac2_fw_region))
-		goto invalid;
-
 	fw_end = (const u8 *)hdr -
 		 hdr->n_region * sizeof(struct mt76_connac2_fw_region);
 
-	for (i = 0; i < hdr->n_region; i++) {
-		const struct mt76_connac2_fw_region *region;
-		u32 region_len;
-
-		region = (const void *)((const u8 *)hdr -
-					(hdr->n_region - i) * sizeof(*region));
-		region_len = le32_to_cpu(region->len);
-		if (region_len > fw_end - fw->data - offset)
-			goto invalid;
-
-		offset += region_len;
-	}
-
 	if (fw_end - fw->data - offset < 16 + sizeof(*rel_info))
 		goto invalid;
 
-- 
2.47.3