[PATCH v3 0/3] wifi: wcn36xx: firmware trust boundary hardening

[Tristan Madani]

From: Tristan Madani <tristan at talencesecurity.com>

This series adds missing bounds checks for firmware-controlled fields
in the Qualcomm wcn36xx driver.

Patch 1 prevents heap overflow from oversized HAL responses. Patch 2
validates PRINT_REG_INFO count. Patch 3 checks trigger BA response
length.

Changes in v3:
  - Regenerated from wireless-next with proper git format-patch.

Changes in v2:
  - No code changes from v1.

Tristan Madani (3):
  wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
  wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO
    indication
  wifi: wcn36xx: fix OOB read from short trigger BA firmware response

 drivers/net/wireless/ath/wcn36xx/smd.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

-- 
2.47.3