mt7921_load_clc() indexes phy->clc[] with the index stored in each CLC record from the firmware image, but does not validate that index before its first array access. The equivalent mt7925 parser added the same validation for a potential array-index out-of-bounds issue and later corrected the comparison from > to >=. mt7921 never received either change; see the linked commits. A malformed CLC region can therefore read or write past phy->clc[] while the driver is starting. Stop parsing the CLC region when a record has an out-of-range index, matching the corrected mt7925 parser. Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support") Link: https://git.kernel.org/linus/9679ca7326e52282cc923c4d71d81c999cb6cd55 Link: https://git.kernel.org/linus/08fa656c91fd5fdf47ba393795b9c0d1e97539ed Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Zhao Li --- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c index 25b9437250f7..1c99645b8122 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -467,6 +467,9 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name) for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) { clc = (const struct mt7921_clc *)(clc_base + offset); + if (clc->idx >= ARRAY_SIZE(phy->clc)) + break; + /* do not init buf again if chip reset triggered */ if (phy->clc[clc->idx]) continue; base-commit: 4a0bd262df757b25fc4e2a53c947317c119ced4e -- 2.50.1 (Apple Git-155)