* [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers
@ 2026-07-11 18:04 Jeff Johnson
2026-07-13 2:06 ` Baochen Qiang
2026-07-14 18:08 ` Jeff Johnson
0 siblings, 2 replies; 4+ messages in thread
From: Jeff Johnson @ 2026-07-11 18:04 UTC (permalink / raw)
To: linux-wireless; +Cc: linux-kernel, Jeff Johnson
The following WMI event handlers currently read from the event buffer
without first verifying that the message was large enough to hold the
expected event:
ath6kl_wmi_scan_complete_rx()
ath6kl_wmi_addba_req_event_rx()
ath6kl_wmi_delba_req_event_rx()
Add length checks to prevent overread.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
---
Changes in v2:
- Added fixes for two more functions: ath6kl_wmi_addba_req_event_rx and ath6kl_wmi_delba_req_event_rx
- v1 subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx()
- Link to v1: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx-v1-1-7b11e5f8b96c@oss.qualcomm.com
---
drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 72611a2ceb9d..08030d88c7d3 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
{
struct wmi_scan_complete_event *ev;
+ if (len < sizeof(*ev))
+ return -EINVAL;
+
ev = (struct wmi_scan_complete_event *) datap;
ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));
@@ -3352,7 +3355,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
struct ath6kl_vif *vif)
{
- struct wmi_addba_req_event *cmd = (struct wmi_addba_req_event *) datap;
+ struct wmi_addba_req_event *cmd;
+
+ if (len < sizeof(*cmd))
+ return -EINVAL;
+
+ cmd = (struct wmi_addba_req_event *) datap;
aggr_recv_addba_req_evt(vif, cmd->tid,
le16_to_cpu(cmd->st_seq_no), cmd->win_sz);
@@ -3363,7 +3371,12 @@ static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
static int ath6kl_wmi_delba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
struct ath6kl_vif *vif)
{
- struct wmi_delba_event *cmd = (struct wmi_delba_event *) datap;
+ struct wmi_delba_event *cmd;
+
+ if (len < sizeof(*cmd))
+ return -EINVAL;
+
+ cmd = (struct wmi_delba_event *) datap;
aggr_recv_delba_req_evt(vif, cmd->tid);
---
base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd
change-id: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers
2026-07-11 18:04 [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers Jeff Johnson
@ 2026-07-13 2:06 ` Baochen Qiang
2026-07-13 23:39 ` Jeff Johnson
2026-07-14 18:08 ` Jeff Johnson
1 sibling, 1 reply; 4+ messages in thread
From: Baochen Qiang @ 2026-07-13 2:06 UTC (permalink / raw)
To: Jeff Johnson, linux-wireless; +Cc: linux-kernel
On 7/12/2026 2:04 AM, Jeff Johnson wrote:
> The following WMI event handlers currently read from the event buffer
> without first verifying that the message was large enough to hold the
> expected event:
> ath6kl_wmi_scan_complete_rx()
> ath6kl_wmi_addba_req_event_rx()
> ath6kl_wmi_delba_req_event_rx()
>
> Add length checks to prevent overread.
>
> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
> Assisted-by: Claude:claude-sonnet-4-6
> Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
> ---
> Changes in v2:
> - Added fixes for two more functions: ath6kl_wmi_addba_req_event_rx and ath6kl_wmi_delba_req_event_rx
> - v1 subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx()
> - Link to v1: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx-v1-1-7b11e5f8b96c@oss.qualcomm.com
> ---
> drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++--
> 1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
> index 72611a2ceb9d..08030d88c7d3 100644
> --- a/drivers/net/wireless/ath/ath6kl/wmi.c
> +++ b/drivers/net/wireless/ath/ath6kl/wmi.c
> @@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
> {
> struct wmi_scan_complete_event *ev;
>
> + if (len < sizeof(*ev))
> + return -EINVAL;
> +
> ev = (struct wmi_scan_complete_event *) datap;
>
> ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));
> @@ -3352,7 +3355,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
> static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
> struct ath6kl_vif *vif)
> {
> - struct wmi_addba_req_event *cmd = (struct wmi_addba_req_event *) datap;
> + struct wmi_addba_req_event *cmd;
> +
> + if (len < sizeof(*cmd))
> + return -EINVAL;
> +
> + cmd = (struct wmi_addba_req_event *) datap;
Nit: No space is necessary after a cast. This is a preexisting issue, since you are
touching, better to fix it together.
>
> aggr_recv_addba_req_evt(vif, cmd->tid,
> le16_to_cpu(cmd->st_seq_no), cmd->win_sz);
> @@ -3363,7 +3371,12 @@ static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
> static int ath6kl_wmi_delba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
> struct ath6kl_vif *vif)
> {
> - struct wmi_delba_event *cmd = (struct wmi_delba_event *) datap;
> + struct wmi_delba_event *cmd;
> +
> + if (len < sizeof(*cmd))
> + return -EINVAL;
> +
> + cmd = (struct wmi_delba_event *) datap;
same here
>
> aggr_recv_delba_req_evt(vif, cmd->tid);
>
>
> ---
> base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd
> change-id: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers
2026-07-13 2:06 ` Baochen Qiang
@ 2026-07-13 23:39 ` Jeff Johnson
0 siblings, 0 replies; 4+ messages in thread
From: Jeff Johnson @ 2026-07-13 23:39 UTC (permalink / raw)
To: Baochen Qiang, linux-wireless; +Cc: linux-kernel
On 7/12/2026 7:06 PM, Baochen Qiang wrote:
>
>
> On 7/12/2026 2:04 AM, Jeff Johnson wrote:
>> The following WMI event handlers currently read from the event buffer
>> without first verifying that the message was large enough to hold the
>> expected event:
>> ath6kl_wmi_scan_complete_rx()
>> ath6kl_wmi_addba_req_event_rx()
>> ath6kl_wmi_delba_req_event_rx()
>>
>> Add length checks to prevent overread.
>>
>> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
>> Assisted-by: Claude:claude-sonnet-4-6
>> Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
>> ---
>> Changes in v2:
>> - Added fixes for two more functions: ath6kl_wmi_addba_req_event_rx and ath6kl_wmi_delba_req_event_rx
>> - v1 subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx()
>> - Link to v1: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx-v1-1-7b11e5f8b96c@oss.qualcomm.com
>> ---
>> drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++--
>> 1 file changed, 15 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
>> index 72611a2ceb9d..08030d88c7d3 100644
>> --- a/drivers/net/wireless/ath/ath6kl/wmi.c
>> +++ b/drivers/net/wireless/ath/ath6kl/wmi.c
>> @@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
>> {
>> struct wmi_scan_complete_event *ev;
>>
>> + if (len < sizeof(*ev))
>> + return -EINVAL;
>> +
>> ev = (struct wmi_scan_complete_event *) datap;
>>
>> ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));
>> @@ -3352,7 +3355,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
>> static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
>> struct ath6kl_vif *vif)
>> {
>> - struct wmi_addba_req_event *cmd = (struct wmi_addba_req_event *) datap;
>> + struct wmi_addba_req_event *cmd;
>> +
>> + if (len < sizeof(*cmd))
>> + return -EINVAL;
>> +
>> + cmd = (struct wmi_addba_req_event *) datap;
>
> Nit: No space is necessary after a cast. This is a preexisting issue, since you are
> touching, better to fix it together.
Yeah, let me make those changes in 'pending'
/jeff
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers
2026-07-11 18:04 [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers Jeff Johnson
2026-07-13 2:06 ` Baochen Qiang
@ 2026-07-14 18:08 ` Jeff Johnson
1 sibling, 0 replies; 4+ messages in thread
From: Jeff Johnson @ 2026-07-14 18:08 UTC (permalink / raw)
To: linux-wireless, Jeff Johnson; +Cc: linux-kernel
On Sat, 11 Jul 2026 11:04:43 -0700, Jeff Johnson wrote:
> The following WMI event handlers currently read from the event buffer
> without first verifying that the message was large enough to hold the
> expected event:
> ath6kl_wmi_scan_complete_rx()
> ath6kl_wmi_addba_req_event_rx()
> ath6kl_wmi_delba_req_event_rx()
>
> [...]
Applied, thanks!
[1/1] wifi: ath6kl: avoid buffer overreads in WMI event handlers
commit: f78703024c71ac60033139b42d040981efe083bb
Best regards,
--
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-14 18:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-11 18:04 [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers Jeff Johnson
2026-07-13 2:06 ` Baochen Qiang
2026-07-13 23:39 ` Jeff Johnson
2026-07-14 18:08 ` Jeff Johnson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox