From: Shitalkumar Gandhi wcn36xx_smd_rsp_process() dereferences msg_header->msg_type to dispatch an incoming message before checking that the buffer is large enough to hold a struct wcn36xx_hal_msg_header. The length is controlled by the remote firmware and can be shorter than the header, causing an out-of-bounds read. Reject messages shorter than the header. Return 0 rather than an error so the SMD transport still consumes the malformed packet, matching the oversized-message handling later in the same function. Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Shitalkumar Gandhi --- v2: - Trim the commit message and drop the incorrect statement that the individual response/indication handlers already validate their own lengths. They do not; those over-reads (wcn36xx_smd_join_rsp(), wcn36xx_smd_switch_channel_rsp(), wcn36xx_smd_get_stats(), wcn36xx_smd_gtk_offload_get_info_rsp(), wcn36xx_smd_process_ptt_msg_rsp()) will be addressed in separate patches. - Add Assisted-by tag per Documentation/process/coding-assistants.rst. Link to v1: https://lore.kernel.org/linux-wireless/20260725185740.56658-1-shitalkumar.gandhi@cambiumnetworks.com/ --- drivers/net/wireless/ath/wcn36xx/smd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c index c0b477345832..32dec45dbb50 100644 --- a/drivers/net/wireless/ath/wcn36xx/smd.c +++ b/drivers/net/wireless/ath/wcn36xx/smd.c @@ -3254,6 +3254,11 @@ int wcn36xx_smd_rsp_process(struct rpmsg_device *rpdev, struct wcn36xx_hal_ind_msg *msg_ind; wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "SMD <<< ", buf, len); + if (len < sizeof(*msg_header)) { + wcn36xx_warn("Corrupted HAL message: length %d\n", len); + return 0; + } + switch (msg_header->msg_type) { case WCN36XX_HAL_START_RSP: case WCN36XX_HAL_CONFIG_STA_RSP: base-commit: 90883c513ca01e77c56b8d94be7de11420c1dacf -- 2.25.1