wifi: iwlwifi: adapt ND match notif sizing to fixed matches array

Switch iwl_scan_offload_match_info::matches to a fixed-size array and
adjust D3 netdetect size handling accordingly.

In MVM D3 paths, compute expected payload size as
offsetof(struct iwl_scan_offload_match_info, matches) + matches_len to
preserve previous behavior after the struct layout change.

In MLD D3 netdetect handling, keep the simple full-notification size
assumption and validate against sizeof(*notif) before accessing data.

This keeps scan offload / netdetect functionality unchanged while
making length checks consistent with the new struct definition.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.4c4346140bcc.I44313ac41daca352e6aecdba09a1c3570c3eea06@changeid

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 08f4cc3ea1c3045eeac15af79ab0cb45834a42fa..ee78371082b094061ad67ddc1daa107a41f5dcbc 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
 /*
- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -1319,7 +1319,7 @@ struct iwl_scan_offload_match_info {
        u8 resume_while_scanning;
        u8 self_recovery;
        __le16 reserved;
-       struct iwl_scan_offload_profile_match matches[];
+       struct iwl_scan_offload_profile_match matches[IWL_SCAN_MAX_PROFILES_V2];
 } __packed; /* SCAN_OFFLOAD_PROFILES_QUERY_RSP_S_VER_3 and
             * SCAN_OFFLOAD_MATCH_INFO_NOTIFICATION_S_VER_1
             */

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 109265149963b5d28ff0d689ec3129eec2996105..6b11fa32ea5c6bb59fa7912f5f324dcaa5fd8ccb 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -2459,13 +2459,15 @@ iwl_mvm_netdetect_query_results(struct iwl_mvm *mvm,
 
        if (fw_has_api(&mvm->fw->ucode_capa,
                       IWL_UCODE_TLV_API_SCAN_OFFLOAD_CHANS)) {
-               query_len = sizeof(struct iwl_scan_offload_match_info);
                matches_len = sizeof(struct iwl_scan_offload_profile_match) *
                        max_profiles;
+               query_len = offsetof(struct iwl_scan_offload_match_info,
+                                    matches) + matches_len;
        } else {
-               query_len = sizeof(struct iwl_scan_offload_profiles_query_v1);
                matches_len = sizeof(struct iwl_scan_offload_profile_match_v1) *
                        max_profiles;
+               query_len = sizeof(struct iwl_scan_offload_profiles_query_v1) +
+                       matches_len;
        }
 
        len = iwl_rx_packet_payload_len(cmd.resp_pkt);
@@ -2819,7 +2821,8 @@ static void iwl_mvm_nd_match_info_handler(struct iwl_mvm *mvm,
        if (IS_ERR_OR_NULL(vif))
                return;
 
-       if (len < sizeof(struct iwl_scan_offload_match_info) + matches_len) {
+       if (len < offsetof(struct iwl_scan_offload_match_info, matches) +
+                   matches_len) {
                IWL_ERR(mvm, "Invalid scan match info notification\n");
                return;
        }