wifi: mt76: fix out-of-bounds access in mmio copy helpers

mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to
ALIGN(len, 4), so a length that is not a multiple of four reads past the
source buffer (write_copy) or writes past the destination (read_copy).
Copy the aligned body in the loop and handle the remaining tail through a
4-byte bounce buffer, keeping the register access width unchanged.

Fixes: 2df00805f7db ("wifi: mt76: mmio_*_copy fix byte order and alignment")
Link: https://patch.msgid.link/20260724124813.3961474-3-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>

0 files changed, 0 insertions, 0 deletions