[PATCH wireless] wifi: wcn36xx: validate band and frequency in survey updates

[Zhaoyang Li via B4 Relay]

From: Zhaoyang Li <heliolee0118@xxxxxxxxx>

WCN3620 only registers the 2.4 GHz band. When scan RX metadata selects
the 5 GHz band, wcn36xx_update_survey() dereferences a NULL supported
band pointer while accessing its channels. This can crash the device
during scanning.

Skip survey updates when the selected band is not registered. Also
return when the frequency does not match any channel in the band,
otherwise the update overwrites the first survey entry for that band.

A retained MSM8916/WCN3620 diagnostic log reports a NULL read at
wcn36xx_rx_skb+0x178/0x720, consistent with accessing sband->channels.
The log lacks a runtime module hash and the raw RX descriptor, so the
exact crash path cannot be independently verified.

Fixes: 29696e0aa413 ("wcn36xx: Track SNR and RSSI for each RX frame")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Zhaoyang Li <heliolee0118@xxxxxxxxx>
---
Testing:
- Built the baseline, this fix, and the two-patch RFC series on
  wireless/main af32da41b032 with ARM64 GCC 14.2.0 and W=1.
  The baseline full build had 1067 whole-tree warnings; incremental
  builds reported none (these counts are not directly comparable).
- Rebuilt complete WCN36xx driver objects from clean for all three
  configurations: no warnings or errors; linking and modpost passed.
- Extracted-source ASan/UBSan tests reproduced the unfixed NULL access
  and unmatched-frequency overwrite. The fix passed 90 survey cases,
  256 synthetic scans, and two ordinary RX selections. Kernel APIs
  were stubbed; full RX and skb lifetimes were not exercised.
- Downstream 7.2.9-ufi-stable: 99/100 scans succeeded, one timed out,
  no survey NULL Oops was observed, and 16 pre-existing mac80211
  invalid-band WARNs remained.
- No native upstream kernel boot or dual-band hardware test was done.

Historical crash evidence:
An MSM8916/WCN3620 6.12.111-ufi-diag log reports a NULL read at
wcn36xx_rx_skb+0x178/0x720 with x0=0. In the retained diagnostic
module this is ldr x2, [x0], accessing sband->channels. Symbol spans
and caller return offsets match. The log lacks a runtime module hash
and the raw RX descriptor, so those cannot be independently verified.
---
 drivers/net/wireless/ath/wcn36xx/txrx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index 8826998797d6..fc371963510f 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -286,6 +286,9 @@ static void wcn36xx_update_survey(struct wcn36xx *wcn, int rssi, int snr,
 		idx = wcn->hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels;
 
 	sband = wcn->hw->wiphy->bands[band];
+	if (!sband)
+		return;
+
 	channel = sband->channels;
 
 	for (i = 0; i < sband->n_channels; i++, channel++) {
@@ -295,6 +298,9 @@ static void wcn36xx_update_survey(struct wcn36xx *wcn, int rssi, int snr,
 		}
 	}
 
+	if (i == sband->n_channels)
+		return;
+
 	spin_lock(&wcn->survey_lock);
 	wcn->chan_survey[idx].rssi = rssi;
 	wcn->chan_survey[idx].snr = snr;

---
base-commit: af32da41b0327b9c6a37856ba82b6760d6c8d10e
change-id: 20261018-codex-wcn36xx-survey-upstream-a3560402fc91

Best regards,
--  
Zhaoyang Li <heliolee0118@xxxxxxxxx>