Re: [PATCH] wifi: mt76: mt7996: validate TLV length in mt7996_mcu_ie_countdown()

[Aamir Ahmed]

Please drop this patch - there is no bug here.

The existing loop condition already covers every byte the body reads:

	while (data + sizeof(*tlv) < tail && le16_to_cpu(tlv->len)) {

struct tlv is 4 bytes and omac_idx is the first byte of struct
mt7996_mcu_countdown_notify, so tag, len and omac_idx all lie at
data..data + 4, strictly below tail. A length smaller than the header
re-parses at a shifted offset but stays in bounds and still advances
the cursor, and a length past the end fails the condition and ends the
loop. The zero-length case is already excluded.

The mt7925 commit I referenced fixed a zero-length hang, which does
not apply here.

Regards,
Aamir Ahmed