[31m1:  68fb957be371 [m[33m![m[32m 1:  97baaa7dca6e[m[33m wifi: rtw88: drop C2H packets shorter than the C2H header[m
    [7m[36m@@[m [mCommit message[m
         Cc: stable@vger.kernel.org[m
         Assisted-by: LLM[m
         Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>[m
    [7m[32m+[m[1m    Reviewed-by: Luka Gejak <luka.gejak@linux.dev>[m
     [m
      ## drivers/net/wireless/realtek/rtw88/fw.c ##[m
    [36m @@ drivers/net/wireless/realtek/rtw88/fw.c: void rtw_fw_c2h_cmd_rx_irqsafe(struct rtw_dev *rtwdev, u32 pkt_offset,[m
[31m2:  9e5c9d9a5bc9 [m[33m![m[32m 2:  24de8d9b35a8[m[33m wifi: rtw88: check the C2H payload length before reading it[m
    [7m[36m@@[m [mCommit message[m
         ignore C2H packets whose payload is too short for the fields the[m
         handler reads. For C2H_SCAN_RESULT, check the length before completing[m
         fw_scan_density, so that a report without payload does not wake the[m
    [7m[31m-[m[2m    waiter.[m
    [7m[32m+[m[1m    waiter. A short HW scan status report is not ignored but completes the[m
    [7m[32m+[m[1m    scan as aborted; otherwise the scan stays pending until something[m
    [7m[32m+[m[1m    aborts it.[m
     [m
         For coexistence responses, this only validates the byte inspected by[m
         rtw_coex_info_response(). Length validation for the queued response's[m
    [7m[36m@@[m [mdrivers/net/wireless/realtek/rtw88/fw.c: void rtw_hw_scan_status_report(struct r[m
      	if (!test_bit(RTW_FLAG_SCANNING, rtwdev->flags))[m
      		return;[m
      [m
    [7m[31m-[m[2;32m+	if (rtw_c2h_payload_len(skb) < 3)[m
    [7m[32m+[m[1;32m+	if (rtw_c2h_payload_len(skb) < 3) {[m
    [7m[32m+[m[1;32m+		rtw_hw_scan_complete(rtwdev, vif, true);[m
    [32m +		return;[m
    [7m[32m+[m[1;32m+	}[m
    [32m +[m
      	c2h = get_c2h_from_skb(skb);[m
      	rc = GET_SCAN_REPORT_RETURN_CODE(c2h->payload);[m