From nobody Sat Jul 25 23:08:03 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F9212D0C89 for ; Sat, 11 Jul 2026 17:09:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783789784; cv=none; b=gWcU0KEwe93+0VHal2Ohap2/GUDu4u1hQAFJ5lrCJbyKpjtCE990YIJkvDKJ5vVoB5xfmu7M+XsVGuH9ZaAURTgilnUSurJ1FkuiV+cRmwBIVrFopSeCdnrbu8SSEWDrNoiedrolRTB5PQKbBc3WcgtmQyLTQMyToBr6FxHHD+k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783789784; c=relaxed/simple; bh=cszv68Y52Jg1PsXFT2+De5hkRtRf/Rhr1q2X/HFkBj8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=COo5SP3na2y2mPeg1sbCJcTViXlsAd0VAjV5L6rQMX8WPJs8THdg2jo/u0WSjNL2Sza2iNb+oTgRsHrnzuusWtdj9Cb7JMAReiGG7t20KsJ4CkpGWndCYwVcc8s5qwbnUxtXeIpN8NfTp6fT7wFgzOUf1M/3qArDLAMv65hJ4L8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=BeZ5VluD; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=hZF68sDO; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="BeZ5VluD"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="hZF68sDO" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66BEOZWR4113457 for ; Sat, 11 Jul 2026 17:09:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=kyE9tVfbp56dU4Bi0JwnUg jE3A6bepO4L+0nMk6KWiE=; b=BeZ5VluDS4ThpqTDyjmoZPScoCDXvyB5RanXQz EUUTSC+khQDCqKMii1pxfJDuHqJqQDXLPNM1Bz7rmIm9uBQ+cHoLi7w/R2gMwafW heOid6yUiqKPSdMSTCWKkltGRskrzsf1PboaxeRhStEvfPYpu27gQAwQBzsIj3By XPZI/RMbwQVuMpOlR0hhf5rKOyk/5C9V1Vk/rMQ2CU+0rZ1fjeq+AOooMULae44n PdSG/BdoKC4gsc9x5dpOKmYW6qvHenD4j0dWS3DgRd8ITrk9e6ywJU51wjj5JxFX 25DIH6aSkCHdwwnqd4LdoknBWYq/uh4Rb5n2fZdIBgzWr4yw== Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fbe9hh9dw-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 11 Jul 2026 17:09:41 +0000 (GMT) Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-c860544c077so1968909a12.3 for ; Sat, 11 Jul 2026 10:09:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783789780; x=1784394580; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=kyE9tVfbp56dU4Bi0JwnUgjE3A6bepO4L+0nMk6KWiE=; b=hZF68sDOVLl3RtiptMnG8vuAz6kWP3XXHfwqqJa9k7yD6RwtKkl5TuM9nj0XU4paFi 35wP6ZyTlXefKMWjv5HEibaS6baUsKlBm4VOwO+NBb7nuALlG3vE/R8NmRn4OYlL7SQC p5aX1h4Rq6eljKRP5EnVZ/ed2xB7C4B/TCNb1rb+++siLl9+kDABMsLKpIK2ObVF/2Lg Fc2cQJRxdTSgXo8+nlii8XVjFQ+DE84YMNrXr6UoQDcy2j/rTHOi2ttHKP4FNkCAUUsp l5o/YyKSiNFRnmHM1NWx1Xi0zDQC9V1q+zI7bYiGvRN5Jb5REkw1vzufYV4m1CLfXMYZ rnzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783789780; x=1784394580; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=kyE9tVfbp56dU4Bi0JwnUgjE3A6bepO4L+0nMk6KWiE=; b=kok1ZnamzA0/SXxEYBzlHFtYsf/Z3Hj5/RjnH3qGXgsQB4tBM9TcfAIRBAm5C6W4o8 oaqX1DGH5mKFKjmku7K9jEplQ8uQIRO9jlSXIfTX0NaWKzyZJHd2M3/NydKcs5trha63 tFu6pdgZqvFEp/2tlfgRw3/ffLT0gxmbuvAhfxnSuJMxREHd8hUW5vaixDcgLLbhhJ3Z cvzhGrc4cmOuwQvZXVUjAdMgihZMpAlZItCYXsr+xBgjiFidodpPwMf/UhSlEnG8hOOd L5Rv38NzuJpCfDUTsBy4cubUFakA1eYi0mJ3PP5A3QpAwooBiHPK8ExPdHt0ZzXNkiKW MQ7g== X-Gm-Message-State: AOJu0YwOeoBk8GU7UvMyoIglI23wrI9Zd9qh0AsTSTtqt+/4sZ6Ng0L5 O3fzfaU7hNjEcJIStqde0oxTQlb9NuiSvng9uTasWOrNUA2Xwx3bLUIiRqwG+nYJkZlaoC6XKQv hoJS4hAK+Wl74ZX0VPvBnSYyY93T5TT1p8Rk8r3QsGDZZ12DsOdoDzCnkpv2pwcPPyd8= X-Gm-Gg: AfdE7cnDGsC0kLwiGZCCHKlvGP/4UpxHBlUsM1MXY1PNeiV/QchCVmngUzu8gZahS8s FSGSTMW5vGriauCA6wdC058HMa2VnhOECyM/KfKVsUczpji5iQBjRQeiOCbQZTi7fpg+kBfW6Ws JpEmiBM9XQxzhJhMy2OdOxY93koP6obm/5Jumfsn4Z6Fj2UYoADvFM8bfjC4z2C1YsDXFxUQWxO LKQXxEFrwdYpPlnXPC/5p56Wifm53TD6EbPIyWWWeitBxMo0jo+kREpY1h5OLz2pN6EQkO/0MK9 swP0YF5czuxb1IsM19b/etMKadf+N4rX0hPWNtra/gmaMkiN54LAaDMopZXsazqAY6LX5RFvWbm ueZOUJEKbOGT8iQVegaiRm2O6J9j1zMeMdg97nZ/8HBcIeX+uB6rwJ558nfR5PhciSQ== X-Received: by 2002:a17:90b:4c89:b0:387:e0db:3fb2 with SMTP id 98e67ed59e1d1-38dc779ac27mr3590768a91.43.1783789780159; Sat, 11 Jul 2026 10:09:40 -0700 (PDT) X-Received: by 2002:a17:90b:4c89:b0:387:e0db:3fb2 with SMTP id 98e67ed59e1d1-38dc779ac27mr3590759a91.43.1783789779729; Sat, 11 Jul 2026 10:09:39 -0700 (PDT) Received: from hu-jjohnson-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311950eb930sm34998890eec.8.2026.07.11.10.09.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Jul 2026 10:09:38 -0700 (PDT) From: Jeff Johnson Date: Sat, 11 Jul 2026 10:09:37 -0700 Subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260711-ath6kl_wmi_scan_complete_rx-v1-1-7b11e5f8b96c@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIANB4UmoC/x3MQQqDMBBA0avIrA0YC4b0KkXCdJzWoRplklZBv Luhy7f4/4DEKpzgXh2g/JMkSyywdQU0YnyzkaEY2qbtGmetwTx2nylss4REGAMt8zpx5qC7Qe/ I0/PmB3RQDqvyS/b//QElNPRV5ZihP88Li+NqinoAAAA= X-Change-ID: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7 To: linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Jeff Johnson X-Mailer: b4 0.14.3 X-Proofpoint-GUID: eGxLcmPlsfoNhIciTp2Pj0w_sSGcJjHa X-Authority-Analysis: v=2.4 cv=SajHsPRu c=1 sm=1 tr=0 ts=6a5278d5 cx=c_pps a=oF/VQ+ItUULfLr/lQ2/icg==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=EUspDBNiAAAA:8 a=MFar82-2d_bT9VDcRPwA:9 a=QEXdDO2ut3YA:10 a=3WC7DwWrALyhR5TkjVHa:22 X-Proofpoint-ORIG-GUID: eGxLcmPlsfoNhIciTp2Pj0w_sSGcJjHa X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzExMDE3MyBTYWx0ZWRfXyVi3J+xcNUs8 73BPm9GpQIhhGbfzn3poLDLhy1DCcs78UHF8qPXly8vAKOePQ1eIkAvqP2iGrqSCSijtzm9n0fS 2AZOHzHdqdxHMAMESUoNFKdyJe6uqqO0JiHgRCfiHaSTbO2ZAcKv+pFQljibugi9FQvKpxKtX1/ /JOYSr4LrXb6Y06aWKCp8DSPGQpKPnpgfjPjdY32KtLGHKLRFABOLsXu0z+sEWqU4oeTJAi6elV 6xZtxAWEQg6mPIm1XbQ8Er3xm6gAoDbbyym9P7CXP+E1BL2+cwPNsBN1CkS1A5sER2WS5NC3oTp 9GXdUEnOXJGS4UjsISB+vwa608g9wHUoB5lXJ4Qc1AymoyshstafDcPVm2IfO36m30BSJr77Wk6 L4tgQKcKHfgNzoLTszbdbAclxXJ6kNBOtHDQQCzqVBBLga/rXHRabPxcPGrS6nesfxUO2Qdexui 1577bqq2c1kFf1Khz4Q== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzExMDE3MyBTYWx0ZWRfX7e2/uxdvHnJf Gu8rvYI5uQV4wTkEOigt/+32ZoQ3zvnKhQUFQv2h/+W1EDXxtajO+dQAz4YmpOsK8ib8dRIGww4 3SDAHFEbDXHo3ePChUKVuEVYNiKOILw= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-11_04,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 bulkscore=0 phishscore=0 clxscore=1015 suspectscore=0 malwarescore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607110173 Currently, ath6kl_wmi_scan_complete_rx() dereferences ev->status without first verifying that the event buffer is large enough to hold a wmi_scan_complete_event. Add a length check to prevent overread. Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath6kl/wmi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/a= th/ath6kl/wmi.c index 72611a2ceb9d..1645f59b0dc1 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c @@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wm= i, u8 *datap, int len, { struct wmi_scan_complete_event *ev; =20 + if (len < sizeof(*ev)) + return -EINVAL; + ev =3D (struct wmi_scan_complete_event *) datap; =20 ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status)); --- base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd change-id: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7