[31m1:  006f2d6aec52 [m[33m![m[32m 1:  a88c970312d3[m[33m wifi: wfx: validate MIB read length before copying to caller[m
    [7m[36m@@[m [mCommit message[m
         wfx_hif_read_mib() copies reply->length bytes from the firmware[m
         response into the caller-provided buffer without checking that[m
         reply->length does not exceed val_len. A firmware response with[m
    [7m[31m-[m[2m    a length field larger than expected causes a heap buffer overflow[m
    [7m[31m-[m[2m    when writing to the caller buffer.[m
    [7m[32m+[m[1m    a length field larger than expected overruns the caller buffer and[m
    [7m[32m+[m[1m    reads past the end of the reply allocation.[m
     [m
         Replace the dead -ENOMEM check with an active validation that[m
         reply->length fits within val_len before the memcpy.[m
     [m
    [7m[31m-[m[2m    Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")[m
    [7m[32m+[m[1m    Fixes: f95a29d40782 ("staging: wfx: add HIF commands helpers")[m
    [7m[32m+[m[1m    Assisted-by: LLM[m
         Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>[m
     [m
      ## drivers/net/wireless/silabs/wfx/hif_tx.c ##[m
    [7m[36m@@[m [mdrivers/net/wireless/silabs/wfx/hif_tx.c: int wfx_hif_read_mib(struct wfx_dev *w[m
    [32m +	if (!ret && le16_to_cpu(reply->length) > val_len) {[m
      		dev_err(wdev->dev, "buffer is too small to receive %s (%zu < %d)\n",[m
      			wfx_get_mib_name(mib_id), val_len, le16_to_cpu(reply->length));[m
    [7m[31m-[m[2;32m+		ret = -EINVAL;[m
    [7m[32m+[m[1;32m+		ret = -EIO;[m
    [32m +	}[m
      	if (!ret)[m
      		memcpy(val, &reply->mib_data, le16_to_cpu(reply->length));[m