From nobody Thu Sep 24 23:33:28 2026 Received: from mail-lr2-f7.google.com (mail-lr2-f7.google.com [74.125.230.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E73164848AC for ; Fri, 18 Sep 2026 14:36:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789742177; cv=none; b=VdYIolzjK7GsggkTRISV9IR2lKqJu5p4fRoicPlutgdI9Uc+iTHTSoY0GtSj9Pzef0CzHflWEOFvSLeGS94fmvEGhZU7lwgkG5GGRubran0UL/lkofJny2OhVpozpuGK2ucOq1uF0XGn5ZNeHZFn3RzBFS/jjEoESsyefv2JobM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789742177; c=relaxed/simple; bh=oHK7jTtToiFcxA/9CIKnKR3YjDf4Xd/qP/4WmuFBlso=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=MK5eS8SVvA7Oq8ilR4tmc/4urK17Q6pGUiHXIe8UKJN2Kq7lctoOEZoiNz7by+ZU08sVzcdRX6OHrbgPmT09ISJAz0vQM39juAmwsXNCX5jH8injJZ2h3GXjkULgPS56aEpig44daUKOSp8dCePbNJpu9c4StsGvZ4wMn0M6e/k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=q6GZOzx+; arc=none smtp.client-ip=74.125.230.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="q6GZOzx+" Received: by mail-lr2-f7.google.com with SMTP id 38308e7fff4ca-3a5acb204daso4725131fa.0 for ; Fri, 18 Sep 2026 07:36:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789742174; x=1790346974; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=80thoqF6oWnfHU18nXpOy6DAO7B/ZBVuVLAIvy3f1Nk=; b=q6GZOzx+hzy2iRbWqUtd613E/F1RSqTkZy6oNpOtQiM22AldCxh7HS9KPHKzTq1dRn UPzCjtFO08wT2CY5eorcv/MRk7YDYX8yOi0qrltD/rGX31xNJacSz9UpTAraXANOUfBY zG+xBKDt4H/ok9tA3pJJHHPEkHGvLuuZcMlPgkEclOUph9KLFyRIXLaB75OxKiGPkVRM 8FcNxB1I5WAt8C/vnCnrP2geeNujKK2WMoRIIkPOouSDvf4zIenD3BB49KIv9WREDHOn 7fTSe7rZSeyhnq+Scx/a/NcFr8coe9JvsoXD9HOtOD976pxEL+zCo5F9xXPaNIS1BYX8 G29Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789742174; x=1790346974; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=80thoqF6oWnfHU18nXpOy6DAO7B/ZBVuVLAIvy3f1Nk=; b=SL/i+10f2rXqkT5k8/cHffQAH8wTp56OCMa15pb9hIs4U6Bv3pfxm4/+mD9/klYZtI z/j8mDzvaH8C+ukpxBTjkfy0uFxZf4E0CQGOUIXxUtoXFKIIUayeiEKqcA3CP4oi3xrH Dhlv/0qZ5n9yu4cR4TsDg7t3IaZ4+HKFeDfLtxJJkG8b7VYMqQQZHDbh54ixs/pPHVPe HbyQKRNOH1ER49ZLlAXyCZVC5sL+d6JuEtkpvOF9HgYQrLc03B93rR5d6vCK+iEVp/I6 HKrJy+gyqis9N7dcsHl0qaHXqmY6ViZGI8BST0P7cxZtSV3VwtmN1NroDDFPcbhU9RcZ qGpA== X-Forwarded-Encrypted: i=1; AKwUvByhwljTasJEJXvJOLKBUayipLDKxbVw+W4ExhjBaFgKvpL8qOQ0zW6MAvGdFtjVSb2LYWm50NFd5F3om28=@vger.kernel.org X-Gm-Message-State: AFuF++lbgTCQ49DdQOQYTeJUsCxUVBO9/6aYpL1LKan7g9hdIM+BC3Qb TVVGfFAzbW6abBO6HkNiJQnf/qmrrET9/ibiOV6Ooyu2B/xU50JLAqK9 X-Gm-Gg: AYBFou1KkSI53TpQ3ALlLfW4D/bSwaM/qR449QPVJMayIcw6QllCo5ppPjNbEqABb1J 1itK5Yp9u0X+HWCFPQw++3x4SS/43blMsQYoDtgbt91j2uHPCKzYUoDLyCvX13c12+jKJ/b0QK5 FiEizpMun4RBSzS7IQ5kwNdGlXe42EZ/ajT4XNLq4H75vPAuITJ6mPJp8GK7BADaZTeUvHBhdyX GBfsaaLJSt10MyChJ7yBToc5kxNnYXGSiF2Cs/xgC1N0PpE6zFKl2pja7YPNgDKh5+im89bL0ap rUOE+wo/gD1Ezg7Nu6Lx0VvE6gS6gkLlXLASrOYiqQqxRA8992+eoJY7gY4Bl8sx2WWbgyz6uhX lBe55Nm+Y0g65k8f86L2XpKsyWfkuWKQHdeAJATwGOVJERzixOC4Aqqyxb/LmzNIumZCu2fqUxK iO6awpyhlr05XiLxLzyfdcYCMHLyzYKVUVo9EnFLEfe95HTfI7WPcf0wvN7qE45ahVHgr7YF/l/ YlRgw== X-Received: by 2002:a05:651c:150b:b0:3a3:749e:319b with SMTP id 38308e7fff4ca-3a5fbf55489mr5837501fa.15.1789742173556; Fri, 18 Sep 2026 07:36:13 -0700 (PDT) Received: from linux ([78.40.184.2]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-3a5fd80eb8csm4784691fa.21.2026.09.18.07.36.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Sep 2026 07:36:13 -0700 (PDT) From: Roman Demidov To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Roman Demidov , Kalle Valo , "David S. Miller" , Jakub Kicinski , "John W. Linville" , Eugene Krasnikov , wcn36xx@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, Tristan Madani , Loic Poulain , Jeff Johnson , Sasha Levin Subject: [PATCH 5.15] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response Date: Fri, 18 Sep 2026 17:35:31 +0300 Message-ID: <20260918143539.97842-1-roman.demidov.nn@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Tristan Madani commit 88a240d86d3d64521f9194abe185ac71cc74d0bd upstream. The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content. Add a bounds check on the response length. Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680= hardware") Signed-off-by: Tristan Madani Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260421135018.352774-2-tristmd@gmail.com Signed-off-by: Jeff Johnson Signed-off-by: Sasha Levin Signed-off-by: Roman Demidov --- Backport fix for CVE-2026-74341 drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/= ath/wcn36xx/smd.c index a778e3e0599e..6ab91ff8338c 100644 --- a/drivers/net/wireless/ath/wcn36xx/smd.c +++ b/drivers/net/wireless/ath/wcn36xx/smd.c @@ -3174,6 +3174,10 @@ int wcn36xx_smd_rsp_process(struct rpmsg_device *rpd= ev, case WCN36XX_HAL_GTK_OFFLOAD_GETINFO_RSP: case WCN36XX_HAL_HOST_RESUME_RSP: case WCN36XX_HAL_UPDATE_CHANNEL_LIST_RSP: + if (len > WCN36XX_HAL_BUF_SIZE) { + wcn36xx_warn("HAL response too large: %d\n", len); + break; + } memcpy(wcn->hal_buf, buf, len); wcn->hal_rsp_len =3D len; complete(&wcn->hal_rsp_compl); --=20 2.53.0