From nobody Fri Jul 24 21:31:26 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C53143CE74 for ; Fri, 24 Jul 2026 15:56:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784908581; cv=none; b=G+EFKnzmxxA9MWtUv76KRMjGCglPwwI0sDaiHu/+paLQEV7EJOwRsNdd/MR9dEOT5h5JU/vN5YBOLNvQkXZwhb00S8XqaBNJQtnJQQbZLCU1CrG0Q6v6TQREiJRbxsOTwbe2N973HXS/ZCKdvrqObTM5yCIKcdMsmc/N7bb5/g0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784908581; c=relaxed/simple; bh=Ky1NaLmW1L4tCDSb3jb09Mafqan+Ag6fA+nxjr0s+Cw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=d9ZeIUJOlIIA7eKrYxL8uYaRPruxzllL3DlKDldKDFVmAHBzoGzOkjx5/4YN1lnSZ73pTLdkcU1zhdKcctgChEO1QOYrOKzOqmhVDYbnDM7Q8Tl8nasaTsml2gY8F477w62myXwkQcnXq8C/4YnaXanRhOGqDX7SpwRf/rAY9F4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=K9Bn8QG3; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=iq7e42AK; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="K9Bn8QG3"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="iq7e42AK" Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66ODb85Z151453 for ; Fri, 24 Jul 2026 15:56:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= HuAdqiDdNFYWjWTfl7xgWrhkU3MoDExevluyPmjhHwA=; b=K9Bn8QG3GNGyrn5D qqhySAoYk5JI4AAsV8PmSA3CDXjq71Kr2sSuqeEW4E2u3YHvmskmpfjM0EpAxtl5 +QSpzviVNhHNBV+RQL/gXmmSvwGyQY+g78FrDdosvZsh3hKMGygEmFXdbDJopQPj jwtR8GztxZVJqNUrmgQ66SgNt46u2en4KA/xV/aLyO4cTMQjDip/OUQ3RIUBn37i ygzV4ctW0/Gwro7trq4IOnAf0kbTlkqCN8EmCbFosW9Dj6sgIrcrtTyMUr7vyUcR aILy8/VY5hLm6SolVlpjR+8KVW/b464DtvdQeBFTP7iJE74ZyxZztz7VtTU5Gxw8 Dwrd7Q== Received: from mail-oo1-f72.google.com (mail-oo1-f72.google.com [209.85.161.72]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fm8ck8nvt-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 24 Jul 2026 15:56:18 +0000 (GMT) Received: by mail-oo1-f72.google.com with SMTP id 006d021491bc7-6aaf58e7003so112534eaf.0 for ; Fri, 24 Jul 2026 08:56:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784908578; x=1785513378; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HuAdqiDdNFYWjWTfl7xgWrhkU3MoDExevluyPmjhHwA=; b=iq7e42AKBXrmGuSJONaja/Y1qQwtMHMzeN360mP7zTdmxL7TH2v2XcM+hZmbbpnrjC ktJEeZZHVPG4QwMnQL7NduvldTyD6H4RgwbA7kPr+DFgI77uVYvvG4KrAwp0V1naya1/ sx9ANQqoO0enx7PnQcfmc2T5z524TZK53+zH2RX1M5SJiZsGoPPaKe/EpMq20reTJqrp PUmGMnQo85icnjtDVJmnp++eAN/4sffHulDe7f/jyHqF2X6ZR5XaUY9G5XQjAnq5cGn7 znatBggkkpGGuoVzaSLf30a1umV9BimSYdsB9w0KgxTx9wvfXiedWmovj9JJg26VLrEo 1Gsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784908578; x=1785513378; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=HuAdqiDdNFYWjWTfl7xgWrhkU3MoDExevluyPmjhHwA=; b=T6tJ1l3qlJdb8nr93opMpzbS+FSEt3KO8v6SBp+yVgS+jl7o0YCvXgtKRRfDhecHv4 ZbisDTJJd4THKOcbuSeu+inkN03FpI48kZYJ+j0F3MqFHnY8AvvyuDRn6iGJZtJF/4Zz FJywraTwgfLIG/EDhhclRcC3FQ5JCOmOirelmR9Q1jfd66E2ZMnduAwTgmr4VjuGQJjF AfB2epXNdgI6k2XzJ03qOBfjzxMDqOmLL/TA/A3EyFeStt2MD0sghhHe+HjvWWwTo9Qy VMFlBe2Z8WrviZnjrHFJpP/wsidSrwiWQfgA/Te/ulkExqsKI9DaBMQtJ5Qsw61utTLL Q8Vw== X-Forwarded-Encrypted: i=1; AHgh+RptjwAXSYJO40cScZbGJBI6hLUmoMlpmHftiyFMOoFmdiPj9STXs2ysicldJlMzx2wcBSwsVy+QIlM/0zc=@vger.kernel.org X-Gm-Message-State: AOJu0YxyzduGDz59rPu8xoCZ6UsYpAXTqVxiZ80fezpcDt4CHObBfZvd oFTG+dfGX7sQBPhjLAUnVpJaFUE/CswqGOnAc16GHyo8/YLxEw5KigGomaGZiUPe6dcDy4E4L3z AaFK2GYuHPrdiWy9Fq/rcGx1jCMBT+p6F4oC1SkdniEu2ui5WnZJJq0cIsdjoKk9k6Qk= X-Gm-Gg: AR+sD13FbXIHnZ8B4jwRrz7eYelYKgXTnAW0dShlEBw3REhaL1ii/IXCNpWpOa3fdR1 v3jPjWCpwdCHkbwNphYSemvZy2PxyH4dUdqeEPSK1/jMsTGJoh6Srqx72kWzksqQuXQoxzqH9f2 FfuzXMgmHjd4Pxho6PzIWcfPIexD8IWlCSyUfN0ICzdWAVtGyXamWtETWyHFVlw4fr+TdG/oVGM UVfhc2dAP+1RYtqnwU63R1f3bCXq4naUyHqiDeXQpX/s8SRbXmDzhXwku3imEYssL66NSIje1RB 1eTtydNcvkrcRFr4uWKc1oCwShbNzIQlE2MPB9L1VIGw2yilX5zztNmhdjW0Fe3UMYWXDG0FAGJ iNzK6oNDqJcBHy+CVuovnY+LjbaJz1Sc6ZC0URlrnHhX9V/63q0tTRgo= X-Received: by 2002:a05:6820:f02c:b0:6a1:7181:6da1 with SMTP id 006d021491bc7-6aad3faa27bmr4236262eaf.18.1784908577758; Fri, 24 Jul 2026 08:56:17 -0700 (PDT) X-Received: by 2002:a05:6820:f02c:b0:6a1:7181:6da1 with SMTP id 006d021491bc7-6aad3faa27bmr4236237eaf.18.1784908577332; Fri, 24 Jul 2026 08:56:17 -0700 (PDT) Received: from hu-jjohnson-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 006d021491bc7-6aaf9385b35sm134591eaf.7.2026.07.24.08.56.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 08:56:16 -0700 (PDT) From: Jeff Johnson Date: Fri, 24 Jul 2026 08:56:13 -0700 Subject: [PATCH ath-next v2 1/2] wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-1-02a45d7246c0@oss.qualcomm.com> References: <20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-0-02a45d7246c0@oss.qualcomm.com> In-Reply-To: <20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-0-02a45d7246c0@oss.qualcomm.com> To: Jeff Johnson Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, ath11k@lists.infradead.org, Rameshkumar Sundaram , Baochen Qiang , Jeff Johnson X-Mailer: b4 0.14.3 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI0MDE0MyBTYWx0ZWRfX+LB90bD1VEIC XpbxMHSaXsSbkUPH7kbGcOYZE62xuXGDqbjeGnCTA1WcMOqjxKregnwGnkBA2tavKulLn6/lu8o RIOdQ44vZBDMa7o6uqgSVkmAu2mFAqM7saOhcVyH8j4y2kD0/mQPVbnjCmsStQakqKlGAnZThbb bQ6mvVkkKXYtdSGuYKi4La2+793Pa1YDXnQzzQJtphL15FVaMFZPE/Z6x6co18XSOyUjKxXBaLD 0N4ByLAxTbGK2vt6rUJmTqy8WmXU7n0bAzs42kYvdJoG9JgJ53kLutt9AvqS3uoJTfJXhFrHi08 537RMRxEtcdMxHqqNzMr4/lu5tGqw+OhymZKYWh20Ni6EgFrSSGRwtRqYulJZ+Vi4Xdsp3stVUJ ty/bZYFMUIx1GKtVi7bLL6WEn55NdTqPlTmXH8V5kw8XFee5LUGx0rnMZj+yT4HOclR3Xdgt5f9 1DLZ4OOCz+MvEugH1kg== X-Proofpoint-GUID: 2guLlGpKbZPX90ZjIZeQ0zyP5kYbTCZF X-Proofpoint-ORIG-GUID: 2guLlGpKbZPX90ZjIZeQ0zyP5kYbTCZF X-Authority-Analysis: v=2.4 cv=F79nsKhN c=1 sm=1 tr=0 ts=6a638b22 cx=c_pps a=wURt19dY5n+H4uQbQt9s7g==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=eoimf2acIAo5FJnRuUoq:22 a=EUspDBNiAAAA:8 a=G0XfPlja2fIICZ3D3WwA:9 a=QEXdDO2ut3YA:10 a=-UhsvdU3ccFDOXFxFb4l:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI0MDE0MyBTYWx0ZWRfX8DjC3JTz3uv/ 5HRJrUBByQZTYFJjVBx1fApOiBDLEW7udIh+tCdBIHzK9WOpWbAIo1n6mgY5EHoZUmdOg4xaz8l zhi8L3uD2go9m7iRJeo1r/VpkYKIhqo= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-24_03,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 adultscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 suspectscore=0 spamscore=0 impostorscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607240143 There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath12k/wmi.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/a= th/ath12k/wmi.c index ad739bffcf88..62a86f2069f3 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -207,6 +207,8 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tl= v_policies[] =3D { .min_len =3D sizeof(struct wmi_per_chain_rssi_stat_params) }, [WMI_TAG_OBSS_COLOR_COLLISION_EVT] =3D { .min_len =3D sizeof(struct wmi_obss_color_collision_event) }, + [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] =3D { + .min_len =3D sizeof(struct ath12k_wmi_pdev_csa_event) }, }; =20 __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len) @@ -374,6 +376,13 @@ ath12k_wmi_tlv_parse(struct ath12k_base *ab, struct sk= _buff *skb) return tb; } =20 +static u32 ath12k_wmi_tlv_data_len(const void *data) +{ + const struct wmi_tlv *tlv =3D (const struct wmi_tlv *)data - 1; + + return le32_get_bits(tlv->header, WMI_TLV_LEN); +} + static int ath12k_wmi_cmd_send_nowait(struct ath12k_wmi_pdev *wmi, struct = sk_buff *skb, u32 cmd_id) { @@ -9057,12 +9066,19 @@ ath12k_wmi_process_csa_switch_count_event(struct at= h12k_base *ab, const u32 *vdev_ids) { u32 current_switch_count =3D le32_to_cpu(ev->current_switch_count); + u32 vdev_ids_len =3D ath12k_wmi_tlv_data_len(vdev_ids); u32 num_vdevs =3D le32_to_cpu(ev->num_vdevs); struct ieee80211_bss_conf *conf; struct ath12k_link_vif *arvif; struct ath12k_vif *ahvif; int i; =20 + if (num_vdevs > vdev_ids_len / sizeof(*vdev_ids)) { + ath12k_warn(ab, "csa switch count num_vdevs %u exceeds tlv array length = %u\n", + num_vdevs, vdev_ids_len); + return; + } + rcu_read_lock(); for (i =3D 0; i < num_vdevs; i++) { arvif =3D ath12k_mac_get_arvif_by_vdev_id(ab, vdev_ids[i]); --=20 2.43.0 From nobody Fri Jul 24 21:31:26 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B978423780 for ; Fri, 24 Jul 2026 15:56:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784908582; cv=none; b=dCQrqM5eR8Yn80JhLoHpZu6skU70bVONU7LpJAMjSZ11lhM/R6x9kpagkYAE/pv+wVxCLSqYXtZMAWxnY/DtTsarcGS3TLu6jUdtge0noZZf8puUcR1UnDkzcGSAJkb7NT7IMhwcTnt1PthikjKi18ThW52eB9zcAYt4c3MGVMw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784908582; c=relaxed/simple; bh=LBgtkloE8/GuU9yJTLYgyOXeGRF1BLbvlP9EB1886kk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mL8WsB5LqgRYQAvGqocSGhN5Xe0+9BK7XH2jhDRSjItL4rVATiJEjth9y16p6CPL/DY5DlrATBGwkCJaqgrIxKR+R0ixyusN08GUwOvkl3pwvvoUMQdIN1bTMj72rJjEUjpn6yGu/Reif20k8JCr6MtztPdAuFOR3PNTTIHksvw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=SVYo7tiA; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=T2k8Omzk; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="SVYo7tiA"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="T2k8Omzk" Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66ODb5k62933423 for ; Fri, 24 Jul 2026 15:56:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= SRwsegGQKk4SAG9Z4lzF8xh53Y8v5nzSjwOE25DwPT4=; b=SVYo7tiAI95+TcoU 0beyV5ls8kb4o7GBtEC0KiPnW8jRk7R7Qj8/6vKiozh3nRNKcTDGGx9QTZeOC0wU at7W8j9pO5gaUmUzyQQ9WcYpLnXb7qLBdPMQIqNZNJ4ONPV4URXFqD5gz19VP7z+ rCC17lfJ0gP/cE3xE6jzTlKRn+4xNoGgXfeu9M/E7wwM6e4rcvRrU+pfTW8M7TRF mb/aPVEcy0sKZEqV0qOf0DNHTCTyegdhs7uLApYPfgeav7iBV8Ms4LGlp1d/f5uK cdwFHVcOmcUywRwaSZcn26l3f19WE/qCIyPxWFm8XwzGrIDA/nTrFyR6Q0i9HiSF J648CA== Received: from mail-ot1-f72.google.com (mail-ot1-f72.google.com [209.85.210.72]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fm8cj8ny6-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 24 Jul 2026 15:56:19 +0000 (GMT) Received: by mail-ot1-f72.google.com with SMTP id 46e09a7af769-7ebe970a21fso488775a34.2 for ; Fri, 24 Jul 2026 08:56:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784908579; x=1785513379; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SRwsegGQKk4SAG9Z4lzF8xh53Y8v5nzSjwOE25DwPT4=; b=T2k8OmzkggaI5+zErMleFCIujpkI7XRoRwcSl2YxGlocRxiADTIa9tHPEHhx78rKcG Z1O3Z/wQNdjvEg5gfXBXU1gCOSeCFWFrt+d/yozVAD9iOseuMkgTY5LXgIk9U34/cCKx P0TPINclT83yhUv1Do4s9sgw0K8MkelKpMRMqlkmcatuzTn5rRny5TZwFohSY0k//ntI 5XFnZeuWXkE6eigMUbbiKPQNxp9MVpfTIpCLVuWxnQOy77DYUsPh718JAQ/e9wUE/Wl9 /zRUieb6Lo9z1cIJ1NOp9X/MiVdP2i9Y0TbFacXjirC6oNZCSvrxpC2MwjgDQCFngETR psOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784908579; x=1785513379; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=SRwsegGQKk4SAG9Z4lzF8xh53Y8v5nzSjwOE25DwPT4=; b=BMIjpyY/xEOeFS8woKgqDTHdc5oKf1qx+7V3TxU4Wux5FQy63gkED5SFSdGonBfr/A XgSUjL2aJI/rQijKJnGvhM2LXtRNfnWGmt2t8X9HIG7BmSO5Hkij6VXviXYyB9/Dm+0N XBBa/7KQxny9fRcKu1HHtO0EawqvoUj4uejBCLXoMKFhMmDr58tXWs9WCJ3ungJ0cigm MtgA+PbWzZ5mBT/2TK3prsRoWP9jJFgUK89V/bFofYUg3GK57NmXrxPFT2QVwUeXXhcP mg4ra7caS+ZBWa33WsrZS2DUDWT/UrEtSVdnoJAs9xxc/rQ8j9ZY7Y+I10ZRHWuoxqbn g+8Q== X-Forwarded-Encrypted: i=1; AHgh+RpZFH3u5gEfmhNxodtKSljaBmVBmhiugqtMQ/O1NR0H2fg3xW7jXri7NRW8XCu44IYsu73LQqra53DQFwU=@vger.kernel.org X-Gm-Message-State: AOJu0YwjwGfLhh6e6yVIXIelK5/uqZTmCdnWxPSpVdpihWQSwyClZXQ4 ux80f3tiX5x2r1DfUPF0f06U+UTqALx7SR5iwIiu+NJJCrDQmMDUDr0Ri9a4DIWOiloUhAorEQN 4aQ3huLdWQ0wV7FnWEp1sDrcV+ejIKQ0Hj3sh26fEaZGpP6o04ylwBQwG8xaZ4w1LJWc= X-Gm-Gg: AR+sD11S+3RTjdeN7+0pewtn/jV5AytfOsZzzj3d+rs6BxpmNlm5wlFdmmKgZJ4rJ2f g3b28H2wByMVZj7BoklHVUWSH718fhmHFlFGPqKFajqqEdU9KJr/05MHuhYv6sVbMbOamaOKJD5 CWLfN9rhlRfQ4C5CAjKCVFEPzzJtlwMAMkNisd8XnO2VPMfhkiErtll3SgZ3EdhI7L5jx5H7fTH QyNPnm0iTvN/Dn830XBUb05dlcBrqlwKaaz7N8l4dK0WQZTCS7ZAIudUS8vtQ0mfZsmd/sbMgJr B0VFPOgABCnPZ9EweMKbXopjJ+CvBqHVFIVxJnyIqk6HHOS8B3u1xz/aw7RvUwhLzNdNMkgNfff h/UaJ+eh4grUl+WLLoDVqnbQJyNMEdH5AnzkR1b/20iIWbcIqyISDklM= X-Received: by 2002:a05:6820:a05:b0:6aa:2fbf:bf4f with SMTP id 006d021491bc7-6aad4148874mr3737941eaf.44.1784908579066; Fri, 24 Jul 2026 08:56:19 -0700 (PDT) X-Received: by 2002:a05:6820:a05:b0:6aa:2fbf:bf4f with SMTP id 006d021491bc7-6aad4148874mr3737914eaf.44.1784908578674; Fri, 24 Jul 2026 08:56:18 -0700 (PDT) Received: from hu-jjohnson-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 006d021491bc7-6aaf9385b35sm134591eaf.7.2026.07.24.08.56.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 08:56:18 -0700 (PDT) From: Jeff Johnson Date: Fri, 24 Jul 2026 08:56:14 -0700 Subject: [PATCH ath-next v2 2/2] wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-2-02a45d7246c0@oss.qualcomm.com> References: <20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-0-02a45d7246c0@oss.qualcomm.com> In-Reply-To: <20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-0-02a45d7246c0@oss.qualcomm.com> To: Jeff Johnson Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, ath11k@lists.infradead.org, Rameshkumar Sundaram , Baochen Qiang , Jeff Johnson X-Mailer: b4 0.14.3 X-Authority-Analysis: v=2.4 cv=GJE41ONK c=1 sm=1 tr=0 ts=6a638b23 cx=c_pps a=+3WqYijBVYhDct2f5Fivkw==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=YMgV9FUhrdKAYTUUvYB2:22 a=EUspDBNiAAAA:8 a=hOGj4-57aE1FpqoUBq4A:9 a=QEXdDO2ut3YA:10 a=eYe2g0i6gJ5uXG_o6N4q:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI0MDE0MiBTYWx0ZWRfXzhLiUgBRzzCt Cze0gC1J/gYUk3ZhhaQ9iDHFOS1Xfo30rALKBB9RmUYOmSBrbgdNW4BITlN2Oe7w4fB+6aAiNUt 4bV1rDoBfioGGhVdeZOon/5VS7sde6NyVB4cj42+mceJcBiRnbIy4l2UAEqkux0g8We6D3KHHLH YVKZ0D0j7OIABRJs2pKkQa+NnZa8lQ4oBx3LAR9U+BqIllCwTqiy9Yy5Ig5RA1ctmvzU/7HKPgp dezwee6seZbSXU+MPNBdXmBeyXImocFGvH1jCLULoxjBeSXVBtYx5Vlw8b98gEo/ftSaad49H57 Q/Z+bga8VYA3TCIT+qSs+udlOgkghpiHzoR0hecAeGPmwy8IUgX/2L9zLPwr2vvltzp1X1VbAYK fRDLqUkiublE5jzDl0zyH9n4UB8oRljtQ1Z0LE7bVkvej0QCvah6UzYqbjJiNPQWcJWSFKGvUBx o3SHu1unZ73GMaGUoxQ== X-Proofpoint-ORIG-GUID: adoHdPkcCojDC2ErVGMw4z7s07Q1PF-y X-Proofpoint-GUID: adoHdPkcCojDC2ErVGMw4z7s07Q1PF-y X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI0MDE0MiBTYWx0ZWRfX35sfrKqDjLwA jhuCVQNmtP6glvVuNs47Fgm60Cr7G0L53Xajc0N6UhYja8gfWGhZSzXg8mNy4XLx0i5ssASDk/F KFPvOvD5WIbhJ2YKSmd2Ckx9U3AWTGs= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-24_03,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 priorityscore=1501 spamscore=0 impostorscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607240142 There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath11k/wmi.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/a= th/ath11k/wmi.c index dca6e011cc40..feb0a0b29c81 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -159,6 +159,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = =3D { .min_len =3D sizeof(struct ath11k_wmi_p2p_noa_info) }, [WMI_TAG_P2P_NOA_EVENT] =3D { .min_len =3D sizeof(struct wmi_p2p_noa_event) }, + [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] =3D { + .min_len =3D sizeof(struct wmi_pdev_csa_switch_ev) }, }; =20 #define PRIMAP(_hw_mode_) \ @@ -262,6 +264,13 @@ const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_= base *ab, return tb; } =20 +static u32 ath11k_wmi_tlv_data_len(const void *data) +{ + const struct wmi_tlv *tlv =3D (const struct wmi_tlv *)data - 1; + + return FIELD_GET(WMI_TLV_LEN, tlv->header); +} + static int ath11k_wmi_cmd_send_nowait(struct ath11k_pdev_wmi *wmi, struct = sk_buff *skb, u32 cmd_id) { @@ -8353,15 +8362,23 @@ ath11k_wmi_process_csa_switch_count_event(struct at= h11k_base *ab, const struct wmi_pdev_csa_switch_ev *ev, const u32 *vdev_ids) { - int i; + u32 vdev_ids_len =3D ath11k_wmi_tlv_data_len(vdev_ids); + u32 num_vdevs =3D ev->num_vdevs; struct ath11k_vif *arvif; + int i; =20 /* Finish CSA once the switch count becomes NULL */ if (ev->current_switch_count) return; =20 + if (num_vdevs > vdev_ids_len / sizeof(*vdev_ids)) { + ath11k_warn(ab, "csa switch count num_vdevs %u exceeds tlv array length = %u\n", + num_vdevs, vdev_ids_len); + return; + } + rcu_read_lock(); - for (i =3D 0; i < ev->num_vdevs; i++) { + for (i =3D 0; i < num_vdevs; i++) { arvif =3D ath11k_mac_get_arvif_by_vdev_id(ab, vdev_ids[i]); =20 if (!arvif) { --=20 2.43.0