From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BAFB72BEFF6 for ; Mon, 29 Jun 2026 04:57:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782709056; cv=none; b=PHbZPTkiMUGfnDm0As+RwK1paDYyoXsyWCSceoJ9Ik9ACIcnuVkMcaTFSjiIlNZvQtTuDaU19O3vIErd6ulW/wRwFO5id7OodMlcdvoUgsjXLuocutvrfzN87tRJ8PcujXk/JbwNvyhQ2xeomFuqcmEeV88TgI3XbVBIrz1JUzk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782709056; c=relaxed/simple; bh=+yoPpe9fIfcB7MaM+dP2uhzUrsLysVEi//fhtVtbXQQ=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=mOzxQTE3luHqYjmWqpsqTSPCuq6SBCLND8FPPDmf0PKHle+vjJ4Ky+ta9RUfSkY6QdaKuy/2/bx718srjrjQ3u8NFfpvDPxVdvoPiVeMXVyfjKzuePNAJbrec0U+ABHF2mY2A0W+EwlPV9akXH+gmjpQErIEq7uqTMqEGyKDaUM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=iWsdy0+F; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=HqXHE/fk; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="iWsdy0+F"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="HqXHE/fk" Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65T4NXtn1730203 for ; Mon, 29 Jun 2026 04:57:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= vf9qngapcjb41EMYs4STog4NK088Mw8MZc/Dzmo7oMA=; b=iWsdy0+FjvuTr905 QjkjrbLwsssTdXCECpovCCRReHhOLyul93GEfMLmwledZSVhoRhnCjd68iFsdy0X k3Npq84py9yVf4Lcu7yZ/jKdMtuKX/r9uXyhwlzuoowhyiKuBwzIbaeukPfkr2TN JAaPZPmxuQ3xMX86lk+6EE/gzTIkSpxTSOmEyG8gARyrhDh+jDI4f9DfsxMNzFhq B1ZA366cixyDuDD5vzw5Tckvk7Qlig2Ddb2dPeOJWrnFQVPvMTR7/E6th4mt1QpC i0csO0EH3dZNUH3Hu5m5B3Mtgthch3IcQWdBiWl9wcm4wqeMg24jzMsErP50s8X+ bWCLUg== Received: from mail-dl1-f70.google.com (mail-dl1-f70.google.com [74.125.82.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4f27t7vcv0-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 29 Jun 2026 04:57:33 +0000 (GMT) Received: by mail-dl1-f70.google.com with SMTP id a92af1059eb24-139fe708181so1256545c88.0 for ; Sun, 28 Jun 2026 21:57:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1782709053; x=1783313853; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=vf9qngapcjb41EMYs4STog4NK088Mw8MZc/Dzmo7oMA=; b=HqXHE/fknd/GJ7CLOAs/wuQIQGvF1r4VSdXqOiZr/Uxke4y06M0qpfT6w0cFZc3sLc uFfch+efyVankS4ZP5RvxMchjoqtLOvXJaRMDiyyHZ9u8o2hoRpTZ3r/Jnejhn591MaH j7qGBKZ8lEVbqsitn7CUFMDIqmF3s8MWGQqxsHyZOh+73RZOm3afY+A4KQy5w8id4DGP 1pBMQ6DnZkzSI0AL+UpkalmnyQnNyRsnLRDRzyNufGiypaCLjJSwUMTwF0b7QVfoLfGG 0mBdI6FF1/3+qNEuANuCAogaMl9M/NM7XRBLevTsMgcZQR1kRwQSaxLFThrMzkR08joP bYuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782709053; x=1783313853; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=vf9qngapcjb41EMYs4STog4NK088Mw8MZc/Dzmo7oMA=; b=srU4wPWCiftQkTz1LGea4FytQHuaNxoU6lhufNgUOfat3DF/+fc+PDsNkRxXZskTZ3 ferq7MdgljcXgYA64Unp317gFHGiRRFLxnKLhJ4RjMAqz/4ZJcw+GZvsGm8AYZ404dNH YS4wgm36Ft1J9BstUdHFiK32yVzsTRIhWPwj1uiNzUQyNKvRApLH2BfyKBDWEbya3KIH 1Au3HmWwKOhFVj/KGt79TMulxA3cdmpQZQPS+++N9NSOQKLZXXB9901gkN6kU+vIJuKP S6o9E2lcuc1MV4w/oTNRKA7lPHFMGkQxGko2iA++FpZbavukPKmeV+ESKvubWngbtNH+ N0jw== X-Forwarded-Encrypted: i=1; AFNElJ+L52RUXOUZ36i1E949tKIOnOME42RXfKE3HJKszgUXg3ieRuuihrdmOfJvTrUZ1UYFeURriS+O1mlTXE0=@vger.kernel.org X-Gm-Message-State: AOJu0Yy2hIRjRH8Mr2rR0SkXi2P6pU/e3lmREtfrSYHJeS7HjPvknxRK xoD1uQkuZTj9XbFsM/N37oJxq0WS49KJXgupP4zUjwXaEi/9BUQWih5FjiTT+VEMDYmZFNBYwqK A73cAGTPTKs+4Lu7HGPwqxioVxrIDbvDSrLUEuudqQ7YSKvMHDC9/MlUnefVljOZiwwE= X-Gm-Gg: AfdE7clxj/v48NFdDd2Xe83t0Vhvtd3XOeTE+t4Xlhikqv7PTY6rQalUjryA0+0IKiX l6lkntdfnzSOUSd2nlgsQHya6RGUQ6dVpaafpiu9pUG/pS/9EZRjxTgg4voqJl87N3QsPlLudBz HNMmeTapw2vW/h3BYshlGBOwU8FYpWmRK+eShlwuXKGfKBiNm6vBL0bwVFMKjad0Pmhl1qIPpVI 63OEOSo9AbKPoBl4DKGKaV073ujf0t9zu49kxza7jMSJrIvSvJcSj299/4wwYyJF8Zd4nw7hTEK 1xMI/MGCHUfBXsrbfHaPiVBxfGpmUYfmnbmpW4TN4qMhxBRqhyPTdwV6htdKdsZrc98oF0l3zvn Bq/ooCvw6pvm8HwXWwNeZ3wlg02BqJN2+p9ijahbCgG+XHUiGs9kKtctOQbq7 X-Received: by 2002:a05:7022:69a7:b0:139:d910:ac58 with SMTP id a92af1059eb24-139dbaa5be1mr12555710c88.20.1782709053339; Sun, 28 Jun 2026 21:57:33 -0700 (PDT) X-Received: by 2002:a05:7022:69a7:b0:139:d910:ac58 with SMTP id a92af1059eb24-139dbaa5be1mr12555703c88.20.1782709052838; Sun, 28 Jun 2026 21:57:32 -0700 (PDT) Received: from [10.168.91.130] ([106.211.250.75]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-139d8f6acf9sm41454685c88.6.2026.06.28.21.57.29 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 28 Jun 2026 21:57:32 -0700 (PDT) Message-ID: <34ad2c6a-b9c3-4f99-97a7-e58fb22e2e78@oss.qualcomm.com> Date: Mon, 29 Jun 2026 10:27:27 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v4] wifi: ath6kl: fix OOB access from firmware ADDBA window size To: Tristan Madani , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Jeff Johnson , Johannes Berg , Tristan Madani References: <178243229402.3653332.17576562809691611363@talencesecurity.com> Content-Language: en-US From: Vasanthakumar Thiagarajan In-Reply-To: <178243229402.3653332.17576562809691611363@talencesecurity.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjI5MDAzOSBTYWx0ZWRfX7jqepW/NTLTM C2JloBWV9+obF6Pxn7yRMSnOQk5r/xqyxH4fmhXdJNdXCFGqD6CqcqpMRC9HADtyN0TKFUqdi14 mTkVJ1UYBqR05df24XKCLsLWcdh8HbZNxPRfykUWLryMkCv2NqgjSoul557mpO4eNadsXrTURvL HEuFaJgiiPv0wdhJYOONggr41MXR/r0Yi0jIC9n4yZehmm3+ru2PApRN7MNKJmri1QhDIQ+8B3o Q/IfYjRD+D2lC+Lg1heBuTSWW4JXXavf5rUDUQliUMDqMciqnc+Tggwis6tJzZh9d4kyLtEb7NH 1wTZt/OwYrg30odEgAEpjyyozUOhFxG/ECX5/VfMZqHKmvnQMK4GUwY7uF99QK/SLof2xJSpbUu HMNAa2Y1MPLRK/WQtU8YkRIZNlOHeBudXDPn3LWcfmdnE57+Kh+utarBrewKZf/eI8WsrhQujaP F+0uDwd67GcTNhv236Q== X-Proofpoint-GUID: -VWsDPnWV8nDojw5prNggsEGtCe2jdAS X-Proofpoint-Spam-Info: AW1haW4tMjYwNjI5MDAzOSBTYWx0ZWRfX29Qt7dzY5iat /yINl1/O++CouIsKUeuOwVhFZ1idoVc2g59/joz+pDu6FYGh6KdZBonqFaV/p4Rj1ja8i9Ny4mp LuzDQKikF2ow8/megkRzcBbYEf8etw4= X-Proofpoint-ORIG-GUID: -VWsDPnWV8nDojw5prNggsEGtCe2jdAS X-Authority-Analysis: v=2.4 cv=BdnoFLt2 c=1 sm=1 tr=0 ts=6a41fb3e cx=c_pps a=SvEPeNj+VMjHSW//kvnxuw==:117 a=piOy77Qi3eXCa7Kn6a748g==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=YMgV9FUhrdKAYTUUvYB2:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=J_-Nd1mkAAAA:8 a=ZtkLO85gcAc21UMs6qIA:9 a=QEXdDO2ut3YA:10 a=Kq8ClHjjuc5pcCNDwlU0:22 a=n8ForQn92ZFaZtFqRdMw:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-29_01,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 phishscore=0 clxscore=1015 suspectscore=0 bulkscore=0 impostorscore=0 spamscore=0 lowpriorityscore=0 adultscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606290039 On 6/26/2026 5:34 AM, Tristan Madani wrote: > aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied > win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not > return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to > compute a kzalloc size and stored in rxtid->hold_q_sz, leading to > zero-size or overflowed allocations and subsequent out-of-bounds access. > > Clean up any previously active aggregation session for the TID first, > then return early when win_sz is out of the valid range, instead of > proceeding with a broken allocation size. > > Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") > Cc: stable@vger.kernel.org > Suggested-by: Vasanthakumar Thiagarajan You can remove my suggested-by as I only provided review comments on your patch. > Signed-off-by: Tristan Madani With the above comment addressed, Reviewed-by: Vasanthakumar Thiagarajan