[PATCH v2 0/2] wifi: p54: validate PDA entry data lengths in eeprom parser

[Shengzhuo Wei]

p54_parse_eeprom() walks PDA records supplied in the device EEPROM but
several handlers consume entry->data without first checking that the
entry actually carries enough bytes, so a malformed or truncated image
makes them read past the EEPROM buffer. This series adds the missing
length checks in two places: the PA calibration curve data and the
interface-list records. It continues the EEPROM trust-boundary
hardening of da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in
p54_rx_eeprom_readback()") and ebd6d37fa94b ("wifi: p54: validate RX
frame length in p54_rx_eeprom_readback()").

Patch 1 rejects the PA calibration curve entry when the channel and
points-per-channel counts it advertises do not fit in the entry data,
the same check p54_convert_output_limits() and p54_convert_db() already
apply to their counts. Patch 2 advances the interface-list walk only
while a full struct exp_if record still fits, instead of reading one
from a trailing partial record.

---
Changes in v2:
- move the curve data length checks into p54_convert_rev0() and
  p54_convert_rev1() (Christian Lamparter)
- collect Acked-by from Christian for the interface-list patch
- Link to v1: https://lore.kernel.org/r/20260827-p54-pda-validation-v1-0-bdc2b0675056@xxxxxxxx

---
Shengzhuo Wei (2):
      wifi: p54: validate curve data length in the calibration curve converters
      wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

 drivers/net/wireless/intersil/p54/eeprom.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)
---
base-commit: 66fb95a521110da673090294561844c9f76ebe64
change-id: 20260826-p54-pda-validation-7b2e91f4c6a3

Best regards,
--  
Shengzhuo Wei <me@xxxxxxxx>