From nobody Sat Jul 25 23:07:59 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDDBE3CF049 for ; Sat, 11 Jul 2026 18:04:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783793089; cv=none; b=mtPbsdIOr1JTwBO3KD0g0eMkVZgjWk1S8U2Z+9P84tu/y6QSzc5FSDSQRnDoFIvX7u9YKFmEowI04BTaq8NHjjKM8hAOUEBewQjz336wAXwcNSwsADJGRmNs0bAijE9YJZe2UnF5pjO9Z8NMGgdJMqeQzI2roRfeekbK5C8k8gc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783793089; c=relaxed/simple; bh=lnV+nloHza+v8f9syCJ1CbdtDAqHJvzPBWtocjoGLYk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=J7CqQTMJE28l3A8EJ4vNLPOC6W7yciMJi2z6eET8ZGyr8H9m1IsnVeDaj8RGTh7/aB1TZx67d3iioRFHRALBtCutu36RhVWNMuLjH3xhCmDGxrjS4A2L/pZNHqQIK5ALhMLBX5gYg0zK+MyqzbJLr3AOzwMTQiOX/YiRbSg484M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=GTiQ2hZ4; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=C5UjXLqn; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="GTiQ2hZ4"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="C5UjXLqn" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66BHvCqp352920 for ; Sat, 11 Jul 2026 18:04:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=cKcR8KK5pzOF3eOQ5hGM8/ rS27j/PhdD/hP4RutQW8A=; b=GTiQ2hZ4s3rZ0Zmf96eFHJsONi8TZx0BVI0y7r ljawJQ3J6hQLfhN3GmXbZ1QCrfSqa8QVsJGruTe8vzvifnAwqwZqHuiLn0JobMhk KQQVWAlTXkPKih63eT26oI+tE4vgMGGI07r4wQQb6GVJAByVHDyxzR4KN05OXkMn OgOtuuh4E5+UHm0Zfqlo0Pt/5okS3fL+QnltZfK3njp21S55x2ykqkt3g7xAPP1W nY3K7u6PiqZOn68mgESfR1U+OCzmZhkkQ6U7drv3XQ/ThVDPgx/qOZBY1m/xDeky 7SNQQZq84LYtZ54bz0ygDzz/3j+KGYP78xDBFcuIpfdAqXfQ== Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fbe8v9asv-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 11 Jul 2026 18:04:47 +0000 (GMT) Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-37d4f23eb37so3262967a91.0 for ; Sat, 11 Jul 2026 11:04:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783793087; x=1784397887; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=cKcR8KK5pzOF3eOQ5hGM8/rS27j/PhdD/hP4RutQW8A=; b=C5UjXLqnfZRd+e4/5jXlzvTiGDw/lZ4FoavJFooEwbXufsTpaC201YBK4yD8K4idKD Cu3K0akF6Map/m1WytuY6ZMB7eZknfy0c+MZHCLnUP8C8OSE6RW/ZXpPBzPEEkbg/w6/ jPkNzI47YvN0IZLayLnK74jjJ2kZU9dDHbeP+tIkEDJMSbp7cDaF5cu8yeZG+HFD/q8K wUioCsuEqw3ZZZyFJjm/i53OF6M8zWy2LpKfNtMi7MPtqDPTsJQMgEMBj74AND+1QwSB kTWIFO05g/SiZJvsGisASJr3/BQIyGJSRotsHy2BpPTaBa83UmMP7HO0MCWHGKqmvjUE V9mQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783793087; x=1784397887; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=cKcR8KK5pzOF3eOQ5hGM8/rS27j/PhdD/hP4RutQW8A=; b=iiBGttgJVNnsSltE9iF5Fc4beHnHqWunYhFXuy5Gsf1gfkQhQEYGScv24MUj7mHgU5 i7jBO3CrIPKI5E6C4lH9zZ0C5n7mDUt7X5c6jYOyhb+1qzOMmo7vWIoJN/ZWre2Cwsuw Hwg1c38BJ/Mnf2t1/wm0Z0pxbQDkJ9xQrjFAojHa1ZKYFBqyjDvJF/DHiHHrYOYq5Jl5 bMT08ii74zwm0aXZBI3LuHMkGpHhlW4PrNrX2y+vlNwgi7zrGlIUoSoPIZJLUs5WbpsN tJoIl8l/F39LFso+8c3mQDgOJq6QkPBjwsA2iL6h+TdWXTynjGQdIRfit91mMe5+/B52 FLhQ== X-Gm-Message-State: AOJu0YyHmnPwuCdGTANU/vlPCH2E3uaQh4z019vdawVASgsrA+e+RrHD HqZBleAuOF6Ba54rcCDlb3IYvzFkdQajXz98n8Kg+0PQLUYFSItBdlxRTYIOV1BGuS5wPwDZhYL BvRKhU8C6TC7xK2K6O7CGwGYzOxq8npv9xpO12V8h/ZDMf6AEJbSd5EeYo7sJW55VaeZg1821p6 A= X-Gm-Gg: AfdE7cmsDJqUqXOpNU5gICfBh8l3ObNob+crXMReZ4f56JptJksiuaG2AH1PaWA8BN5 WRL7csUazVMmjOgYsRIZIXumBQ6LkVk+WaEVVoBzTcEEG5tKBnjes5iJiTarLESVSCD+ju+NUUd WSGnjaTgw793s6j0sBVOBFtnOCBYT+e9mazRZ6fbGMFyRRGsoXU0Cl6glaTOQXwkmIqTwQ74eJz /Cq3/iV2wqGLY4pvwvS6jh00IzZtzI04EQl9pts1JBelwLYCa5PTvcrqtnxDSn159pZc4pgSURb FvuPgE3+xG+vF5g4nOWe6XgiPSpinuG80gE6hE7hchuTZgZ2T2XOuvES+95RZgEJ0DIHAt8Sw4h WEb+ELQVrPrq5Nb8RtQ4fqZK7ZnBSvbxXTm1Xz4SKLMyqji8teZn60SHCEDa9k6WMeQ== X-Received: by 2002:a17:90b:2685:b0:380:9d0d:7af8 with SMTP id 98e67ed59e1d1-38dc7758d62mr3376771a91.20.1783793086641; Sat, 11 Jul 2026 11:04:46 -0700 (PDT) X-Received: by 2002:a17:90b:2685:b0:380:9d0d:7af8 with SMTP id 98e67ed59e1d1-38dc7758d62mr3376742a91.20.1783793086169; Sat, 11 Jul 2026 11:04:46 -0700 (PDT) Received: from hu-jjohnson-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311935fd091sm34895356eec.24.2026.07.11.11.04.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Jul 2026 11:04:45 -0700 (PDT) From: Jeff Johnson Date: Sat, 11 Jul 2026 11:04:43 -0700 Subject: [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260711-ath6kl_wmi_scan_complete_rx-v2-1-22dc0f7f45e7@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIALqFUmoC/42NQQ6CMBREr0L+2hI+RmpdeQ9DmlI+0ggttgUxh LvbcAI3k0zmzcwGgbyhALdsA0+LCcbZZMpTBrpX9knMtMlDWZRVwRGZin31GuRnNDJoZaV24zR QJOlXpgTXQjdn0SoOaWHy1Jn1WH9AKjI9e082Qp3C3oTo/Pd4XvBA/jpZkCHjDSJdumsjKn13I eTvWQ2JGvMkUO/7/gPdAcC42gAAAA== X-Change-ID: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7 To: linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Jeff Johnson X-Mailer: b4 0.14.3 X-Proofpoint-ORIG-GUID: tTc2SnlKe5m_mgGpvg9ir5v_xqUXevCU X-Proofpoint-GUID: tTc2SnlKe5m_mgGpvg9ir5v_xqUXevCU X-Proofpoint-Spam-Info: AW1haW4tMjYwNzExMDE4MyBTYWx0ZWRfX2NthgaAUecwv AVICeM+KiufJmlZCq7DW6v35S9Tqrpb3Xc5uSBLuw3RpsPSsth1EeY5wPCgAgWVV4fN+8BLpIGC VMyNAaIU/Rx+qBXElGzIRwJ34DFWIWQ= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzExMDE4MyBTYWx0ZWRfX3tar1fvzk4e5 dkOv119fiQpN540cJtiwrKe/rwI1A5ENahN38mqjVf4VqUbfTKr9vNSaJVbiiM7UfNhM83Fe3OC nV0N5c9io//+ZjQOjphOWk52OqsCRpxRRdcZeH5NUX1YhQAEg0NoO2Km02/Lo9EMXOPiZzIoBqu Q79J56wH/8BU/nevgbcG8O6tD+gT50a+0U5KQbfHVQuG8qHJJ2w6UWAlhu42CcoIoyWlXVp7VLN LxuOnz1x96dNxGtp0BvsbwcMKYRHM40I4AhXHVPye1UpbX2r1HC1mIP4BbIPZ3cDfmQZE/N8az1 hpe7sXeYmq6aJhD2GVD1QE+vTS+K6pvI2f8+3D2dL+rhEXbqHq/zt2ZFvksBOF58vbmweLL4Z5k 9/rt8tMO+FFmki2qThz3Ua6afSOit+SVTBDA2CBYJSGPJiCmfTRptwg7g4vDndl6nJMih1WhCs1 r3BUjsRPYPQQPPKgPZg== X-Authority-Analysis: v=2.4 cv=WONPmHsR c=1 sm=1 tr=0 ts=6a5285bf cx=c_pps a=0uOsjrqzRL749jD1oC5vDA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=2r72hCCS2uxvEu3KRW0A:9 a=QEXdDO2ut3YA:10 a=mQ_c8vxmzFEMiUWkPHU9:22 a=FO4_E8m0qiDe52t0p3_H:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-11_05,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 adultscore=0 impostorscore=0 phishscore=0 clxscore=1015 malwarescore=0 bulkscore=0 priorityscore=1501 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607110183 The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event: ath6kl_wmi_scan_complete_rx() ath6kl_wmi_addba_req_event_rx() ath6kl_wmi_delba_req_event_rx() Add length checks to prevent overread. Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Jeff Johnson Reviewed-by: Baochen Qiang --- Changes in v2: - Added fixes for two more functions: ath6kl_wmi_addba_req_event_rx and ath= 6kl_wmi_delba_req_event_rx - v1 subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in at= h6kl_wmi_scan_complete_rx() - Link to v1: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx= -v1-1-7b11e5f8b96c@oss.qualcomm.com --- drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/a= th/ath6kl/wmi.c index 72611a2ceb9d..08030d88c7d3 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c @@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wm= i, u8 *datap, int len, { struct wmi_scan_complete_event *ev; =20 + if (len < sizeof(*ev)) + return -EINVAL; + ev =3D (struct wmi_scan_complete_event *) datap; =20 ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status)); @@ -3352,7 +3355,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct= wmi *wmi, u8 *datap, static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int l= en, struct ath6kl_vif *vif) { - struct wmi_addba_req_event *cmd =3D (struct wmi_addba_req_event *) datap; + struct wmi_addba_req_event *cmd; + + if (len < sizeof(*cmd)) + return -EINVAL; + + cmd =3D (struct wmi_addba_req_event *) datap; =20 aggr_recv_addba_req_evt(vif, cmd->tid, le16_to_cpu(cmd->st_seq_no), cmd->win_sz); @@ -3363,7 +3371,12 @@ static int ath6kl_wmi_addba_req_event_rx(struct wmi = *wmi, u8 *datap, int len, static int ath6kl_wmi_delba_req_event_rx(struct wmi *wmi, u8 *datap, int l= en, struct ath6kl_vif *vif) { - struct wmi_delba_event *cmd =3D (struct wmi_delba_event *) datap; + struct wmi_delba_event *cmd; + + if (len < sizeof(*cmd)) + return -EINVAL; + + cmd =3D (struct wmi_delba_event *) datap; =20 aggr_recv_delba_req_evt(vif, cmd->tid); =20 --- base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd change-id: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7