[PATCH wireless 0/1] wifi: wcn36xx: fix scan RX panic on WCN3620

[Alexander Vernel]

Hi,

I hit a kernel panic while working on display support for my Lenovo
TB-X103F and tracked it down to the wcn36xx receive path.

The tablet uses a WCN3620, which only supports 2.4 GHz. A firmware scan
result was being interpreted as 5 GHz, and the driver dereferenced the
missing band in wcn36xx_update_survey(). The frequency in the crash was
5280 MHz.

Stephan Gerhold already had a workaround for this in the msm8916 tree [1].
This patch follows the same approach, but checks the registered bands
rather than the radio ID. It also drops scan results if the resulting
frequency isn't in the channel tables.

With the fix, the tablet completed a 20-minute run with Wi-Fi scan requests
and file transfers without another panic. I haven't confirmed whether the
bad firmware report occurred again during that run. A host test reproduces
the NULL-band failure with the original code and passes with the fix.
Hardware testing so far is WCN3620 only.

AI tools assisted with crash analysis, adaptation of the workaround,
testing and preparation and review of this submission.

Thanks,
Alex

[1] https://github.com/msm8916-mainline/linux/commit/0be2d63a476e83c757d9caafc22eae00bcfd1df8

Alexander Vernel (1):
  wifi: wcn36xx: validate scan bands against radio capabilities

 drivers/net/wireless/ath/wcn36xx/txrx.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)


base-commit: 6c377d19d4a5116d9bec5203aa3c6c11523e7898