wifi: nxp: add nxpwifi driver for IW61x

Hello Jeff Chen,

Commit 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") from Jun 5, 2026 (linux-next), leads to the following Smatch static checker warning:

	drivers/net/wireless/nxp/nxpwifi/uap_cmd.c:1054 nxpwifi_set_11ax_status()
	error: __memcpy() 'ax_cfg.data[4]' too small (50 vs 255)

drivers/net/wireless/nxp/nxpwifi/uap_cmd.c

    1019 int nxpwifi_set_11ax_status(struct nxpwifi_private *priv,
    1020                             struct nxpwifi_uap_bss_param *bss_cfg,
    1021                             struct cfg80211_ap_settings *params)
    1022 {
    1023         struct nxpwifi_11ax_he_cfg ax_cfg;
    1024         u8 band = bss_cfg->band_cfg & BAND_CFG_CHAN_BAND_MASK;
    1025         const struct element *he_cap;
    1026         int ret;
    1027 
    1028         if (band == BAND_2GHZ)
    1029                 ax_cfg.band = BIT(0);
    1030         else if (band == BAND_5GHZ)
    1031                 ax_cfg.band = BIT(1);
    1032         else
    1033                 return -EINVAL;
    1034 
    1035         ret = nxpwifi_send_cmd(priv, HOST_CMD_11AX_CFG,
    1036                                HOST_ACT_GEN_GET, 0, &ax_cfg, true);
    1037         if (ret)
    1038                 return ret;
    1039 
    1040         he_cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
    1041                                         params->beacon.tail,
    1042                                         params->beacon.tail_len);
    1043 
    1044         if (he_cap) {
    1045                 ax_cfg.he_cap_cfg.id = he_cap->id;
    1046                 ax_cfg.he_cap_cfg.len = he_cap->datalen;
    1047                 if (params->twt_responder == 0) {
    1048                         struct nxpwifi_11ax_he_cap_cfg *he_cap_cfg =
    1049                         (struct nxpwifi_11ax_he_cap_cfg *)he_cap;
    1050 
    1051                         he_cap_cfg->cap_elem.mac_cap_info[0] &=
    1052                                 ~HE_MAC_CAP_TWT_RESP_SUPPORT;
    1053                 }
--> 1054                 memcpy(ax_cfg.data + 4,
    1055                        he_cap->data,
    1056                        he_cap->datalen);
                                ^^^^^^^^^^^^^^^

Smatch thinks we need some bounds checking on this. The comments on cfg80211_find_ext_elem() suggest this is true. I've been starting to use ChatGPT to review Smatch warnings and it says the

	he_cap_cfg->cap_elem.mac_cap_info &= ~HE_MAC_CAP_TWT_RESP_SUPPORT;

assignment on line 1051 is a concern as well since that was supposed to be const... But I think const here is more of a guideline than a hard requirement?

    1057         } else {
    1058                 /* disable */
    1059                 if (ax_cfg.he_cap_cfg.len &&
    1060                     ax_cfg.he_cap_cfg.ext_id == WLAN_EID_EXT_HE_CAPABILITY) {
    1061                         memset(ax_cfg.he_cap_cfg.he_txrx_mcs_support, 0xff,
    1062                                sizeof(ax_cfg.he_cap_cfg.he_txrx_mcs_support));
    1063                 }
    1064         }
    1065 
    1066         return nxpwifi_send_cmd(priv, HOST_CMD_11AX_CFG,
    1067                                 HOST_ACT_GEN_SET, 0, &ax_cfg, true);
    1068 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter