Re: [PATCH ath-next v2] wifi: wcn36xx: validate HAL message length in rx callback

[Loic Poulain]

On Sun, Jul 26, 2026 at 9:42 AM Shitalkumar Gandhi
<shital.gandhi45@xxxxxxxxx> wrote:
>
> From: Shitalkumar Gandhi <shitalkumar.gandhi@xxxxxxxxxxxxxxxxxxx>
>
> wcn36xx_smd_rsp_process() dereferences msg_header->msg_type to dispatch
> an incoming message before checking that the buffer is large enough to
> hold a struct wcn36xx_hal_msg_header. The length is controlled by the
> remote firmware and can be shorter than the header, causing an
> out-of-bounds read.
>
> Reject messages shorter than the header. Return 0 rather than an error
> so the SMD transport still consumes the malformed packet, matching the
> oversized-message handling later in the same function.
>
> Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@xxxxxxxxxxxxxxxxxxx>

Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>

> ---
> v2:
>  - Trim the commit message and drop the incorrect statement that the
>    individual response/indication handlers already validate their own
>    lengths. They do not; those over-reads (wcn36xx_smd_join_rsp(),
>    wcn36xx_smd_switch_channel_rsp(), wcn36xx_smd_get_stats(),
>    wcn36xx_smd_gtk_offload_get_info_rsp(),
>    wcn36xx_smd_process_ptt_msg_rsp()) will be addressed in separate
>    patches.
>  - Add Assisted-by tag per Documentation/process/coding-assistants.rst.
>
> Link to v1: https://lore.kernel.org/linux-wireless/20260725185740.56658-1-shitalkumar.gandhi@xxxxxxxxxxxxxxxxxxx/
> ---
>  drivers/net/wireless/ath/wcn36xx/smd.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
> index c0b477345832..32dec45dbb50 100644
> --- a/drivers/net/wireless/ath/wcn36xx/smd.c
> +++ b/drivers/net/wireless/ath/wcn36xx/smd.c
> @@ -3254,6 +3254,11 @@ int wcn36xx_smd_rsp_process(struct rpmsg_device *rpdev,
>         struct wcn36xx_hal_ind_msg *msg_ind;
>         wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "SMD <<< ", buf, len);
>
> +       if (len < sizeof(*msg_header)) {
> +               wcn36xx_warn("Corrupted HAL message: length %d\n", len);
> +               return 0;
> +       }
> +
>         switch (msg_header->msg_type) {
>         case WCN36XX_HAL_START_RSP:
>         case WCN36XX_HAL_CONFIG_STA_RSP:
>
> base-commit: 90883c513ca01e77c56b8d94be7de11420c1dacf
> --
> 2.25.1
>