1:  0e762c214e29 ! 1:  6325c86e7333 wifi: nxpwifi: validate scan response TLV sizes before indexed access
    @@ Commit message
         fewer TLV entries than BSS entries leads to reads past the TLV buffer.
     
         Add bounds checks that verify each indexed access falls within the
    -    TLV data length before dereferencing. Initialize chan_band to NULL and
    -    fw_tsf to zero at the start of each iteration so that a short TLV does
    -    not leave stale values from the previous BSS entry. Gate the
    -    neighbor-discovery branch on chan_band being non-NULL to prevent
    -    dereferencing an uninitialized pointer when the bounds check rejects
    -    the current entry.
    +    TLV's declared length before dereferencing.
     
         Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
         Cc: stable@vger.kernel.org
    @@ Commit message
     
      ## drivers/net/wireless/nxp/nxpwifi/scan.c ##
     @@ drivers/net/wireless/nxp/nxpwifi/scan.c: int nxpwifi_ret_802_11_scan(struct nxpwifi_private *priv,
    - 	}
    - 
    - 	for (idx = 0; idx < scan_rsp->number_of_sets && bytes_left; idx++) {
    -+		chan_band = NULL;
    -+		fw_tsf = 0;
    - 		/*
    - 		 * If a TSF TLV is present, save its TSF value in fw_tsf. This
    - 		 * is the firmware TSF at the time the beacon or probe response
      		 * was received.
      		 */
      		if (tsf_tlv)
    @@ drivers/net/wireless/nxp/nxpwifi/scan.c: int nxpwifi_ret_802_11_scan(struct nxpw
     +					&chan_band_tlv->chan_band_param[idx];
     +				radio_type = &chan_band->radio_type;
     +			} else {
    -+				chan_band = NULL;
     +				radio_type = NULL;
     +			}
      		} else {
      			radio_type = NULL;
      		}
    - 
    --		if (chan_band_tlv && adapter->nd_info) {
    -+		if (chan_band && chan_band_tlv && adapter->nd_info) {
    - 			adapter->nd_info->matches[idx] =
    - 				kzalloc(sizeof(*pmatch) + sizeof(u32),
    - 					GFP_ATOMIC);