[PATCH ath-next v2] wifi: wcn36xx: validate HAL message length in rx callback

[Shitalkumar Gandhi]

From: Shitalkumar Gandhi <shitalkumar.gandhi at cambiumnetworks.com>

wcn36xx_smd_rsp_process() dereferences msg_header->msg_type to dispatch
an incoming message before checking that the buffer is large enough to
hold a struct wcn36xx_hal_msg_header. The length is controlled by the
remote firmware and can be shorter than the header, causing an
out-of-bounds read.

Reject messages shorter than the header. Return 0 rather than an error
so the SMD transport still consumes the malformed packet, matching the
oversized-message handling later in the same function.

Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi at cambiumnetworks.com>
---
v2:
 - Trim the commit message and drop the incorrect statement that the
   individual response/indication handlers already validate their own
   lengths. They do not; those over-reads (wcn36xx_smd_join_rsp(),
   wcn36xx_smd_switch_channel_rsp(), wcn36xx_smd_get_stats(),
   wcn36xx_smd_gtk_offload_get_info_rsp(),
   wcn36xx_smd_process_ptt_msg_rsp()) will be addressed in separate
   patches.
 - Add Assisted-by tag per Documentation/process/coding-assistants.rst.

Link to v1: https://lore.kernel.org/linux-wireless/20260725185740.56658-1-shitalkumar.gandhi@cambiumnetworks.com/
---
 drivers/net/wireless/ath/wcn36xx/smd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index c0b477345832..32dec45dbb50 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -3254,6 +3254,11 @@ int wcn36xx_smd_rsp_process(struct rpmsg_device *rpdev,
 	struct wcn36xx_hal_ind_msg *msg_ind;
 	wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "SMD <<< ", buf, len);
 
+	if (len < sizeof(*msg_header)) {
+		wcn36xx_warn("Corrupted HAL message: length %d\n", len);
+		return 0;
+	}
+
 	switch (msg_header->msg_type) {
 	case WCN36XX_HAL_START_RSP:
 	case WCN36XX_HAL_CONFIG_STA_RSP:

base-commit: 90883c513ca01e77c56b8d94be7de11420c1dacf
-- 
2.25.1