wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

The firmware-controlled rsp->count field is used as the loop bound for
indexing into the flexible rsp->regs[] array without validation against
the message length. A count exceeding the actual data causes out-of-
bounds reads from the heap-allocated message buffer.

Add a check that count fits within the received message.

Fixes: 43efa3c0f241 ("wcn36xx: Implement print_reg indication")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135018.352774-3-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index f65328329f4f08f878c5b60d2a6ac1d01663f61f..2a0c946d81095070c3b9b3ec33552aee75dc402c 100644 (file)
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2805,6 +2805,12 @@ static int wcn36xx_smd_print_reg_info_ind(struct wcn36xx *wcn,
                return -EIO;
        }
 
+       if (rsp->count > (len - sizeof(*rsp)) / sizeof(rsp->regs[0])) {
+               wcn36xx_warn("Truncated print reg info indication: count %u, len %zu\n",
+                            rsp->count, len);
+               return -EIO;
+       }
+
        wcn36xx_dbg(WCN36XX_DBG_HAL,
                    "reginfo indication, scenario: 0x%x reason: 0x%x\n",
                    rsp->scenario, rsp->reason);