wifi: mt76: mt7925: fix incorrect TLV length in CLC command

The previous implementation of __mt7925_mcu_set_clc() set the TLV length
field (.len) incorrectly during CLC command construction. The length was
initialized as sizeof(req) - 4, regardless of the actual segment length.
This could cause the WiFi firmware to misinterpret the command payload,
resulting in command execution errors.

This patch moves the TLV length assignment to after the segment is
selected, and sets .len to sizeof(req) + seg->len - 4, matching the
actual command content. This ensures the firmware receives the
correct TLV length and parses the command properly.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Cc: stable@vger.kernel.org
Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
Acked-by: Sean Wang <sean.wang@mediatek.com>
Link: https://patch.msgid.link/f56ae0e705774dfa8aab3b99e5bbdc92cd93523e.1772011204.git.quan.zhou@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 1379bf6a26b5bf6e163728bca0a2d8c9d9c04f69..abcdd0e0b3b5aec2cbb8e47be237914986d6b690 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -3380,7 +3380,6 @@ __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
                u8 rsvd[64];
        } __packed req = {
                .tag = cpu_to_le16(0x3),
-               .len = cpu_to_le16(sizeof(req) - 4),
 
                .idx = idx,
                .env = env_cap,
@@ -3409,6 +3408,7 @@ __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
                memcpy(req.type, rule->type, 2);
 
                req.size = cpu_to_le16(seg->len);
+               req.len = cpu_to_le16(sizeof(req) + seg->len - 4);
                dev->phy.clc_chan_conf = clc->ver == 1 ? 0xff : rule->flag;
                skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
                                           le16_to_cpu(req.size) + sizeof(req),