From nobody Fri Jul 24 04:55:45 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 824EB313E24 for ; Fri, 24 Jul 2026 01:31:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784856695; cv=none; b=hYzs4l4BzsI4X4nGlvcZehEM3LFZ47cD+iWjuM2UAPnFQpe4AEwoghJ8uW3d0kSQkSRut3f/Ni5mrdjo/LogIXFRcOM1oNNzlADgKEVTWxJIg0DSilSEaR3Xg42mOkUyw288vrdZiowl7Keu45nTIkycZg4+TwZft7RAGDfwTLI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784856695; c=relaxed/simple; bh=TD1OMp7b4XA2iZp/R7pxmK/m5k9FQunAW2XbbVd6r5A=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=jr5ufdduI16A3tDM7yA34nwlzAqJyCnzKRojXeXKXjYiuzZVMCe8cy+oQcESFhdViZWDpOBFvh2YK6l5l03YI7y88Qx41QRYqppyfEA7xebVC3KWjmgFvnmm1uAemOZnsWs8N3d2GMygRfytwbWQxKXed+pipi9/u1nrNkaz6dQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=XNncgK7v; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=fp8kKNHT; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="XNncgK7v"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="fp8kKNHT" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NLeRLl1202122 for ; Fri, 24 Jul 2026 01:31:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 5SMXxutj/MIuag2+HC9usTCdJHe0gkRdicMpw/jumME=; b=XNncgK7vGyN12FIy Jfp1Uvjn/a1vIfzZKhxyGZNTDm8wt1OAbouoTB6LjbbOs/G2+zAqteikfF5HSdWQ HUkRt3fSpNWIiLrARYserte2y/7hX1/nPwdVSwkTAZ3LmNR1ntPwMK/DlkLQZQjc Mv96O4HWFvAuz7Y47MLWfgk91e/gfsgzgfvwXGnnbiy9u5H6gMxks0Ff20D4p4QE 5sAMEocCCaOJpl1LJzQFutf+Zjuml4IklCiHlgi0s8I7oIcq0wdhyLHhZ2bHKTws 9ZfZrHwRelldSqbYIr+JqH4U2R1pP66I5gpa43i/92V/BQP83laMATw5lpPfhSHc pJ8Qdw== Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fkqamsg3j-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 24 Jul 2026 01:31:32 +0000 (GMT) Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-cb5cc1e13f8so1568381a12.3 for ; Thu, 23 Jul 2026 18:31:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784856691; x=1785461491; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=5SMXxutj/MIuag2+HC9usTCdJHe0gkRdicMpw/jumME=; b=fp8kKNHTc+GWVT2rQ8JoipXdeNM6vU1ndtzOa0QM2f/DlytxKwyXeMd3CYlXSqzF3L 2eFwZhzRuAXEs7DG6UmUbWC9dgWkUl3v/i7ESV2D3ClAWvflGwRFGefet6uHThLvyTSI +xSzB7EVAC3iN8DaICr9qrAxgQEpA0Q81Fa2Ok63itkN3Lp3CFdX4QzXYW0+jvgLhUdg RyOUmuUwPIiRvaoLFTYKk64VPo0UOh5wSOTX0/U4eVXAc7l6/7aFz7HxH2+i4laDnanJ QjKfyayzSumjPQB4N5nyTjkw5do1VBaiD825vBnUSUypoIt4GnzIQ3+MB/4JSzdxek33 IerA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784856691; x=1785461491; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5SMXxutj/MIuag2+HC9usTCdJHe0gkRdicMpw/jumME=; b=JQ60Am7gT64w584nNXT5IowqgYnS80RFDt6jlaUZ3DXIUvf8dpMf7NUY0YuxVA7p56 ra0sGTZwP7CxLyb4GNylE2nlzhJ1SwloW/Oc2EbDnLS3OdtfkmhPjaBiecmVlhRKI4PI bUA4EOuHsaykgw7bcgFe6fjXCtRsPXkc8be8etGJrjmnB/9c2h+PFMxwFYrh3JrUVPcu pL8juoRAEisqBjXrJcG8y2YJCBq1JWjdN/6xf2yJyTgyMyMvQ586lN/QhocEwn0tgo1Z bkfzutGLHKbnNmK2XUWXK4k3ZZpo9FlRGBiSDt6LZnYxHUU36HlMcGgy/znArWlL3R/U EWhA== X-Forwarded-Encrypted: i=1; AHgh+RpNKrM3lsTkxlldxMsJ2i0xu9pre8cFJVNQQNffWRdXDj/XCZrc8xjt+REr025vB1BT58KVFeXQItdWGiE=@vger.kernel.org X-Gm-Message-State: AOJu0YwzCY+CPhTpo5ExEJrHLouPHxr4VecZJcKHyNxx5C12ZRjKodpZ lkn8TMGu7rAAb3icFGibyL0ACeXPCBk5rsMYE0uEGTmGfdn3Ej5B+uH/SrrnPjt6na4RZf8/vo9 Z0pS7IR4aeFQJ4ZydP4VP/g5mEpZpjZ3yhRfr5A3PdPyxkibghqueXGEKTqCMKLcgyyg= X-Gm-Gg: AR+sD10+GYzb/PG2H6LdMuGIqi5u2EJBB8JyI6wFOYLQ6UjJovEH1eRxHLeB57XLZzJ DhQsNvHsWImjaCmSyXG2ltN4nNUjSJgg93twnKx/vSYFoRmXGz8ZSd2u9hOQZqorKvh5buusm65 K2GbVEPw5K4H+5YZqewMiXja7q9B/fWusP9czSo2TyWH0x28kIHWX7V+a6r5x2LkxVRzAwERRyu SaVxmUtUuJrobcNnZ2Xa6FLYZf6J6kEvO7j3gViYDI//aNhsn/yjMHWDv3k7oMeN1unR+x3am6W lTPav3NBdK2Ygk4LcEJrD7h/UQGg8Rd8cCN+3Ogt/zWchAqKqQeso1Y0QffU+ec+3Jd8BdFDUYb ZpCP3JexVcLjBtxiG0d4MOjTd/fGlmhgeMwZK6iqTwZ8ywtxtw42OpVc= X-Received: by 2002:a05:6300:95:b0:3c3:a1ed:3c23 with SMTP id adf61e73a8af0-3c44b00675emr6588597637.23.1784856691316; Thu, 23 Jul 2026 18:31:31 -0700 (PDT) X-Received: by 2002:a05:6300:95:b0:3c3:a1ed:3c23 with SMTP id adf61e73a8af0-3c44b00675emr6588558637.23.1784856690772; Thu, 23 Jul 2026 18:31:30 -0700 (PDT) Received: from hu-jjohnson-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147df0ba0asm22655306eec.18.2026.07.23.18.31.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 18:31:29 -0700 (PDT) From: Jeff Johnson Date: Thu, 23 Jul 2026 18:31:24 -0700 Subject: [PATCH ath-next 1/2] wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260723-ath12k_wmi_process_csa_switch_count_event-cleanup-v1-1-c01ef10bc6a3@oss.qualcomm.com> References: <20260723-ath12k_wmi_process_csa_switch_count_event-cleanup-v1-0-c01ef10bc6a3@oss.qualcomm.com> In-Reply-To: <20260723-ath12k_wmi_process_csa_switch_count_event-cleanup-v1-0-c01ef10bc6a3@oss.qualcomm.com> To: Jeff Johnson Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, ath11k@lists.infradead.org, Jeff Johnson X-Mailer: b4 0.14.3 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI0MDAxMSBTYWx0ZWRfX4CWMpyatOfCK 49sFBpJk5v66L29a9Ga2dqW00tW3VL2dOQi9aLnEZUX/ashKNXt9W5Vni/W1f+U+L3ZmSwqJ3a2 kF5hJ3H9nv/LYPAcHTwgdSAjm58YjiBy9gPAIULPp4br3WEC0xAlmnd0lGqXBMx7ER/mnYH3XFA spXuJSEhnhmxpDWK3LPjxgYDhJza973btble3oR3Vly9kssA7iWP5Zi2WpoQEh7WrzpCjQwlPDv I0Kzb0nngNFw5zami+8tPZ4DCOuO9IZ/ZUC25D95zimODQHBB9J4t0FXGu3giH96IBPkS/Y10kK SDJLTlvq1mx+UYkmTc1GqKGpfgLMO7VFTt2gTzXk7D0hCTxHZ3Cp74w4AFYrZpThbFM2ZnU29uA t9040cxRjV7dbMMrAJ366i+zgCCw2VnS+DOeW6y7xT8ghrHWeBFeC+8v40V+YmXcij8a1uQPWRE 22H76bQLnSIE+dL3MJw== X-Proofpoint-GUID: JGP6KPta2OElVmTbToX2nhOKeUKqlWfm X-Authority-Analysis: v=2.4 cv=DfAnbPtW c=1 sm=1 tr=0 ts=6a62c074 cx=c_pps a=oF/VQ+ItUULfLr/lQ2/icg==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=G0XfPlja2fIICZ3D3WwA:9 a=QEXdDO2ut3YA:10 a=3WC7DwWrALyhR5TkjVHa:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI0MDAxMSBTYWx0ZWRfXy9ABXJWrG5OJ vppePNOsKysmHDkf8zCOpJoVEIPusqClq3d/Zmuv2kLiYjdwgZuxwzepK0eBY2LE7KIMNMuB0kq b40F6e4BDvw/WWlQINh/44mwxsd47Fk= X-Proofpoint-ORIG-GUID: JGP6KPta2OElVmTbToX2nhOKeUKqlWfm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 clxscore=1015 suspectscore=0 spamscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 adultscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607240011 There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath12k/wmi.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/a= th/ath12k/wmi.c index ad739bffcf88..62a86f2069f3 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -207,6 +207,8 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tl= v_policies[] =3D { .min_len =3D sizeof(struct wmi_per_chain_rssi_stat_params) }, [WMI_TAG_OBSS_COLOR_COLLISION_EVT] =3D { .min_len =3D sizeof(struct wmi_obss_color_collision_event) }, + [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] =3D { + .min_len =3D sizeof(struct ath12k_wmi_pdev_csa_event) }, }; =20 __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len) @@ -374,6 +376,13 @@ ath12k_wmi_tlv_parse(struct ath12k_base *ab, struct sk= _buff *skb) return tb; } =20 +static u32 ath12k_wmi_tlv_data_len(const void *data) +{ + const struct wmi_tlv *tlv =3D (const struct wmi_tlv *)data - 1; + + return le32_get_bits(tlv->header, WMI_TLV_LEN); +} + static int ath12k_wmi_cmd_send_nowait(struct ath12k_wmi_pdev *wmi, struct = sk_buff *skb, u32 cmd_id) { @@ -9057,12 +9066,19 @@ ath12k_wmi_process_csa_switch_count_event(struct at= h12k_base *ab, const u32 *vdev_ids) { u32 current_switch_count =3D le32_to_cpu(ev->current_switch_count); + u32 vdev_ids_len =3D ath12k_wmi_tlv_data_len(vdev_ids); u32 num_vdevs =3D le32_to_cpu(ev->num_vdevs); struct ieee80211_bss_conf *conf; struct ath12k_link_vif *arvif; struct ath12k_vif *ahvif; int i; =20 + if (num_vdevs > vdev_ids_len / sizeof(*vdev_ids)) { + ath12k_warn(ab, "csa switch count num_vdevs %u exceeds tlv array length = %u\n", + num_vdevs, vdev_ids_len); + return; + } + rcu_read_lock(); for (i =3D 0; i < num_vdevs; i++) { arvif =3D ath12k_mac_get_arvif_by_vdev_id(ab, vdev_ids[i]); --=20 2.43.0 From nobody Fri Jul 24 04:55:45 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A6DB3168EF for ; Fri, 24 Jul 2026 01:31:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784856695; cv=none; b=s0tH2bux5I3KRh4nqELAi3dWIBtpckLEd6RhfMknKu33Jixz/Sj/kzm+d/s/+tVCSWsMSolrf1ohRHckVNfjbrM5FsXTgNhqLxmIbJI44HxTcryVtnwak0egvDPcu8b69Tz2nUrO6pXLVH3bWZjNWHcophGTsog/aNcm4I89ESw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784856695; c=relaxed/simple; bh=Rh+E2ZN3ua6IyAeXqtWu4hX8gnsRqJQPvjrnnPEVYz4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=eB1tbSj3oBafSndKdsTmxGvCmSGmoSzqDjgG3j1getz94G7C+TB6hv2LxB371ECfTvCzusbpsP0g2Cf3ZpU4v6aIULzbxmw6j5KsqwSIa4V13MglpMDZJZ0ZCL8a4dUAPj1T/W+C4mwVkduHcGAD+j+tadJX1WVt6vgVqoyTiek= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=QCvoq+Qg; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=H8PHOja2; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="QCvoq+Qg"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="H8PHOja2" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NMT0Bv697168 for ; Fri, 24 Jul 2026 01:31:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= u8vVF6hHkGu1xxeXQmSUf7FgyLwedcYDTnsRmaxHtcc=; b=QCvoq+QgAd28XEsF 1bijWBEel5NOwmESsCpjNRWLADJHd1iuAZHYFPdDPqYDyy1L0i2bx1Bn0cP9K0QS EP3rQZ9vp/q3hrmivt/a+2WWWhU7iBbCjRGLloHmaiVJPAB5RnOzjCcRZqQFVGW9 P9q+LAB6Z0fLHZx33ocysxm9p6R3L6IqLp+bfFLeVuZWLD7uB/kTZv/4qzA1TMWE Na65oAHTZ9ywMSLJFENXXgsV1Ac/ZcDX7ff+LVszhkgUuIbWF3ItMmczCeEYGyQU eGxfjDW5PkoNlgqJKz/scDslDCt3s98qHnE/e1ut5hiHa1IMUc+kpHLRpOfKazW+ nlOP/w== Received: from mail-pg1-f198.google.com (mail-pg1-f198.google.com [209.85.215.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fkusrre5h-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 24 Jul 2026 01:31:33 +0000 (GMT) Received: by mail-pg1-f198.google.com with SMTP id 41be03b00d2f7-c88cfe287e1so1108177a12.1 for ; Thu, 23 Jul 2026 18:31:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784856693; x=1785461493; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=u8vVF6hHkGu1xxeXQmSUf7FgyLwedcYDTnsRmaxHtcc=; b=H8PHOja2bRJjxgs3Y0JR0Pt04HQeZm/aAnI1jbtk7Y1k3yD0nljNdpzqCgAf4wk8Ct RWiWYyvmTWx25fX6Wzq6cjwOWFV4B8U5MVljHB5l3FXUtOI2ZSA9MThHsMk30lCJbS9t oPnXb/w2wtTJhLvVAaaKMseXFnUzLqwexuzOFGBX/7H9pDfm/rjq9jj6YzUp83KIlU80 /WAL0+otVpQFDQgOnf7kmUE2apzR7xaXm9osZrs6Ph05xI+bUYbLhM6bv6tyUInDqlIL UterHrkt+6/yQ+Ymx3e0w3zo+PoefB2kOY/W2mqV98u3qNKUMTjcSOwvQB5wnURMqCB1 7EFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784856693; x=1785461493; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=u8vVF6hHkGu1xxeXQmSUf7FgyLwedcYDTnsRmaxHtcc=; b=J1tA/lalB3ksM4fJ4sd0xMsiNucWkY6FZa8bLpnjdMTJc2SdaAeA7/awkOSuTijDyW dljkMBow8bgsqeJUUhutpx5GWYAoetTAD4qrE4fXhCpWD7o13kItSe2I2+iswHiDNMQs 0YzMUTfVFGqTMFmbUTFU9NrQRlBSH/y+LLt65ZwQcQbdiYIBjtJl6tvQGuEtebeCSoOt 357y9HhHQQ5XQKc8Xcyb8n0TDjgTjDGXH8DJJrvgkWcZQ/isgHiDVkryOiEU9k9HchiM WtOgHMkMWR8rRErqPo7bZAUcbNlBWLtnukGUa6IWyKebeyohwBmP4LRJPSTLyKrnW511 wnmg== X-Forwarded-Encrypted: i=1; AHgh+RpRrree0N8qX+0UP6EUc8NsRQFFo293rKmO6VVasEzJxBeT/bqepnrj4/74osX8AockJ3x6Xlbme7LKhRE=@vger.kernel.org X-Gm-Message-State: AOJu0YxB2W6lVm+rDl0s2r1UCPUF/pUrxMUwV5TJ6Lgk7B6VNcotsKrl yMgWZ3NxnIQ+5gnRnAUwN/XI0OciEBMtbyUF8Vkoe9D4fmgTAL7wdnRltrds19NtLkPfXmqez8Y s+NzjGIIhHRKFcY885pNNo3rRbn1n/g3fSuN/OX6GhikI7hYvlK2jV2aCVsVwpQ0rscQ= X-Gm-Gg: AR+sD1153swRfGoI0BAyHeJS9815LMYmjSKlQMVPUjPfmtV1C1XrhgAlWUIBh/qPYEH MY8mWy6Tcu1e0MXI25CB+sgzSTJleYRqmdwibuuvgg/jSJgWyV6gwz887sqPl0II0w6J6iCjSee vjoOUWQta5EHkPzJaBvZE3a8uWTaqlAXKFxcigVGyvzjQbYNNWUTrQdH09mh3QrL1wAig4ztd3O y8zlbJVuw1zNm5HMu4eqbbVcyyCDrt3fr7/gJa6dPtaqoUSBUprTiYN+dlV3yhOh8jxq9TyFY8l VkPg9tX9MCdoXu9yL2wvvykcvaJZ238lJlwGw6zm0ZcvcnrBzr7eqmop/y7rdkX57fH1SPwpeBR XP9erYPZAXrNulLH4lIkVeNF9di/Ef1aY7thbmwmcxdvSr2Q7LsRcY5E= X-Received: by 2002:a05:6a21:9182:b0:3c3:9df0:2d66 with SMTP id adf61e73a8af0-3c44afcf8bcmr6254465637.6.1784856692692; Thu, 23 Jul 2026 18:31:32 -0700 (PDT) X-Received: by 2002:a05:6a21:9182:b0:3c3:9df0:2d66 with SMTP id adf61e73a8af0-3c44afcf8bcmr6254435637.6.1784856692249; Thu, 23 Jul 2026 18:31:32 -0700 (PDT) Received: from hu-jjohnson-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147df0ba0asm22655306eec.18.2026.07.23.18.31.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 18:31:31 -0700 (PDT) From: Jeff Johnson Date: Thu, 23 Jul 2026 18:31:25 -0700 Subject: [PATCH ath-next 2/2] wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260723-ath12k_wmi_process_csa_switch_count_event-cleanup-v1-2-c01ef10bc6a3@oss.qualcomm.com> References: <20260723-ath12k_wmi_process_csa_switch_count_event-cleanup-v1-0-c01ef10bc6a3@oss.qualcomm.com> In-Reply-To: <20260723-ath12k_wmi_process_csa_switch_count_event-cleanup-v1-0-c01ef10bc6a3@oss.qualcomm.com> To: Jeff Johnson Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, ath11k@lists.infradead.org, Jeff Johnson X-Mailer: b4 0.14.3 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI0MDAxMiBTYWx0ZWRfXwd+7BqvehaOs v2JG5rg72ebVqDvoeZZtW+dL2dudRVirLAMPQcUlIrkM4qPXDyZMPzXGaas/ezHKzSfhFc5fGoD N+bV9Hv+/q1Fq9WVlBaTVEg7v3ACzg4= X-Proofpoint-ORIG-GUID: _jvUeHocntOJLJ2gcG4Bpas-PXitoAfW X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI0MDAxMiBTYWx0ZWRfX+t9GPndhJjc0 ERemahMYB/YOBMQE4k3xy+eGl8KWsbpPSQc0Pswh263AQ7bGMo0zsZVwkQ4+D2x4naZoVecpR/U QYwgzObCP59h51NaHsGSGbn/U0kk5ATHdTrwr9YW+D39GrTIskCCI3OlDtMDVgrJdGYsi17DkIW 5kXwDaCK/tD2ANypMLtNMemdeZ4i9Nph9JXds4T92y+1Yyc3ACZwQt1WDx/35OeJykK6b+B94hu veiAzUM2fe+4VolekyC2/eDKSueF5fgfilWinhT3meoZm7b4uD0fHBf35fjrp1BAquFPoVCRSd0 6tEr7h8Tpx4xlQ8bjxjARw4W9PwDK9nhlUnMzlqfEvmWk9DwN7V8TJELmq8CiO/IPb2/i5S9zIm 0ireTr25OReg4tJj5tKX8NsRFQ6725pqJ1VHx4M+LrkKWcDqjJcz7zPXdRli4lcXKR/8pMlJtOc 6UctwB2p2oQ6R9AlRyg== X-Authority-Analysis: v=2.4 cv=PtejqQM3 c=1 sm=1 tr=0 ts=6a62c075 cx=c_pps a=Qgeoaf8Lrialg5Z894R3/Q==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=EUspDBNiAAAA:8 a=hOGj4-57aE1FpqoUBq4A:9 a=QEXdDO2ut3YA:10 a=x9snwWr2DeNwDh03kgHS:22 X-Proofpoint-GUID: _jvUeHocntOJLJ2gcG4Bpas-PXitoAfW X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 clxscore=1015 suspectscore=0 malwarescore=0 phishscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 spamscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607240012 There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath11k/wmi.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/a= th/ath11k/wmi.c index dca6e011cc40..feb0a0b29c81 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -159,6 +159,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = =3D { .min_len =3D sizeof(struct ath11k_wmi_p2p_noa_info) }, [WMI_TAG_P2P_NOA_EVENT] =3D { .min_len =3D sizeof(struct wmi_p2p_noa_event) }, + [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] =3D { + .min_len =3D sizeof(struct wmi_pdev_csa_switch_ev) }, }; =20 #define PRIMAP(_hw_mode_) \ @@ -262,6 +264,13 @@ const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_= base *ab, return tb; } =20 +static u32 ath11k_wmi_tlv_data_len(const void *data) +{ + const struct wmi_tlv *tlv =3D (const struct wmi_tlv *)data - 1; + + return FIELD_GET(WMI_TLV_LEN, tlv->header); +} + static int ath11k_wmi_cmd_send_nowait(struct ath11k_pdev_wmi *wmi, struct = sk_buff *skb, u32 cmd_id) { @@ -8353,15 +8362,23 @@ ath11k_wmi_process_csa_switch_count_event(struct at= h11k_base *ab, const struct wmi_pdev_csa_switch_ev *ev, const u32 *vdev_ids) { - int i; + u32 vdev_ids_len =3D ath11k_wmi_tlv_data_len(vdev_ids); + u32 num_vdevs =3D ev->num_vdevs; struct ath11k_vif *arvif; + int i; =20 /* Finish CSA once the switch count becomes NULL */ if (ev->current_switch_count) return; =20 + if (num_vdevs > vdev_ids_len / sizeof(*vdev_ids)) { + ath11k_warn(ab, "csa switch count num_vdevs %u exceeds tlv array length = %u\n", + num_vdevs, vdev_ids_len); + return; + } + rcu_read_lock(); - for (i =3D 0; i < ev->num_vdevs; i++) { + for (i =3D 0; i < num_vdevs; i++) { arvif =3D ath11k_mac_get_arvif_by_vdev_id(ab, vdev_ids[i]); =20 if (!arvif) { --=20 2.43.0