[PATCH v3 0/3] wifi: wcn36xx: firmware trust boundary hardening

Jeff Johnson jeff.johnson at oss.qualcomm.com
Sat Jun 6 08:54:11 PDT 2026


On Tue, 21 Apr 2026 13:50:15 +0000, Tristan Madani wrote:
> This series adds missing bounds checks for firmware-controlled fields
> in the Qualcomm wcn36xx driver.
> 
> Patch 1 prevents heap overflow from oversized HAL responses. Patch 2
> validates PRINT_REG_INFO count. Patch 3 checks trigger BA response
> length.
> 
> [...]

Applied, thanks!

[1/3] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
      commit: 88a240d86d3d64521f9194abe185ac71cc74d0bd
[2/3] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
      commit: df2187acfca6c6cca372c5d35f42394d9c270b09
[3/3] wifi: wcn36xx: fix OOB read from short trigger BA firmware response
      commit: b5e6f21923ca89d90256e7346301056f6502691e

Best regards,
-- 
Jeff Johnson <jeff.johnson at oss.qualcomm.com>




More information about the wcn36xx mailing list