From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0BB4035E1C1 for ; Mon, 13 Jul 2026 23:39:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783985998; cv=none; b=RYcxvl6+ijy1JszVfOXzCAOmgEKzx/V38cBibocZ5TiphqrRGQeOSgFnNbLA/d2Lt2MA49iHyIxtNzUyGLa6xSKyCwIxMCg07lSHnnB94PBIwz34sWp2GVh1GVUwXkDXACuGrCEoCiJ4NbUyT0/WFWdUXrPGjZVZHrs7UfYSGkI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783985998; c=relaxed/simple; bh=hCxIYrjzCvzufFJ+2PtEn8e8x/CkphV39I0OeHTRUPw=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=CdnnYEf/AO/DGsdS7x6CKEKgyBcLp5Q7dz8nGNRsziV5c/AiUE3/u8Bx9QX+KGiYX6iqx2Ho9PDXsUX0BbnBoC9NGnwlXwMab/YAY6O/Fw3xoAxfK2HPn8bQOjkd3k9f8LJnfxzG9y0BVtBimGTfE+7uc0nBMiWzI/XzkByZp7E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=D7h/+U41; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=TFeOfy5j; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="D7h/+U41"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="TFeOfy5j" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66DJAeHe2159249 for ; Mon, 13 Jul 2026 23:39:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= iOGyuai475L8l/K5PDfSguK/bb4C7qykXUbNoYzeG1k=; b=D7h/+U41l8Eh/+Mf yOdwEhiiLFTwLBq0e64CbcVkdF9bN0/7Nbfn8NJgxUwNWQ4nf7rRyNWeVjEUrgFS /usbEeN2LjW7LIPXyrsJ2b/wDjNEapfmdBLypSnZRKp77PJQCzkDTRKOF2evyaoK QvN8oL8R32SO1Ly1cfX2rNo9gj4JD/6tE/8Pdmmuhw3jNGuTmQ4xGYZsQOtHoat2 sr3ud1G9sQoQwfZWQT+PSEAGWxUiN9XOsczStEjzEgilSkUQZLZVDmYYIywHfFxg b7WpL/806iuPKgtAWE+F46rppCSxOa1QC5Jy1mmLBtQfU89TwHQR47ftwigpurLk ZHtIRw== Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fcw4qu3pw-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 13 Jul 2026 23:39:56 +0000 (GMT) Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-cab3e9cd922so315328a12.0 for ; Mon, 13 Jul 2026 16:39:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783985996; x=1784590796; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=iOGyuai475L8l/K5PDfSguK/bb4C7qykXUbNoYzeG1k=; b=TFeOfy5jyHlSpjinWnozVP3Ye2dmKJniQyIFDMeizO/60enRKq3+kSoTPTka4trsQL Q4GzltCZnTKm4rtSSXiBaUbOqbWIn3Jp5ZUMyJYUzVT8OxZRSQx5FFM4WIuSnrwFgaz1 AkQeHKOkCPsoY1g6PiF2TI7i4+Pg8wnbzOFzYWHLVm60voP7VMaqpLsNOTgPLSyRDRBB 8QJVuNAB0NV5RuMmNEh+o1+G1N4UD8IJHwcqR9mOJKYpJXzSDjyPYAc/c8SgRYSgdxeh 9kfwIuw+69aoALANHUrbILtx12hlYTC6LteG+aEUUMgq9cXq4+3v3p0qy4+os119dDdy QZfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783985996; x=1784590796; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=iOGyuai475L8l/K5PDfSguK/bb4C7qykXUbNoYzeG1k=; b=omOM9DlQeTobVuJekn376e4D59Dyov1pjSbFYz4luLB3Y0paBAkB1wXUOazx3zIMCm RpgdV75+hvN9EimJl7Ng8ctfOkbK/bupe+KrdbPl8+8hgACS8T+YJlTwxerYbuqR58hc y6NfuH5kqlg/ZBY9KbW+PL9XJPb6Cy0Pqyzv9H2hp//rMDawTbsHwTeJZNvDDHUMPUUB fYwL2N+JtxMyuTGNcjqq1073H7Lg9519fQ+gcp8NkVwdI+WVfYzznEtKm46RL7G2hhhb fMTzSpzkfPXuTjzkVgOSuXIjhyFLlJI7a5Kt/FoSwXLRhvNBtKuLM3bqUFDBDP0yUVwl NnaA== X-Gm-Message-State: AOJu0Yz7zlsQaVgKYZyGWRrLwboDUQZqrmbidNAJSh3nhK9unTX/5uSC 9AA/mkQiGIkK8Rec/jzq4ybvA9+75Ss9HvsPIXS2vfTM4N5U9NMiYw0rKGNnyWzsFo/ZYuBdr8G LXG0MYKI0Fh/MXE7rbd7xuPqKMc+qXSUuIzcal7c9ejI4Kkqo7o5lbchxIK5e9mxifdY= X-Gm-Gg: AfdE7cmL7rHXVS4s54RuU/5dsrsmBREgKhI76AJ8gotLBK+N+XkfFpz3P+X6QYVZjlC I1eRmT6fj1JoEvzHgJKzWlfFXpTW024tO71p+Jxonw7mfBkZaa4ZQxqf89UIRqSQ5LVFzWKmQJ8 rzhcvrN7xwRTkP7iyCIUZdn3u/G/BSrhL6Rxx/ifQYUwL2N3HkhQ1RdEFfO/0kBCveLTWvT//3N xFbXrnbyJnIfoehpfzGnW+unCexaiS+9CDtHZ+WVjB8D9lwGSoHzz+BAAZmTAODn9U2u2NEJ32i +JL9LMOTAQsg7jRn/Cjhd+FUhMaHg2U45bR+vflMq6gs6VrSB16EO2X5tzC2Bo5/YFNDa4Ehlj2 EfUOU/3r7o6FgDYeni2BzqTjp/lJ34AdSSB6yN7UKuJ4sSz6wFI42jxlvCN8W7whDDDd0 X-Received: by 2002:a05:6a20:734a:b0:3be:b0b3:3962 with SMTP id adf61e73a8af0-3c1102d7cb5mr10384833637.9.1783985995638; Mon, 13 Jul 2026 16:39:55 -0700 (PDT) X-Received: by 2002:a05:6a20:734a:b0:3be:b0b3:3962 with SMTP id adf61e73a8af0-3c1102d7cb5mr10384807637.9.1783985995137; Mon, 13 Jul 2026 16:39:55 -0700 (PDT) Received: from [192.168.1.11] (15.sub-75-218-246.myvzw.com. [75.218.246.15]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3118389d9bcsm62806565eec.20.2026.07.13.16.39.54 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 13 Jul 2026 16:39:54 -0700 (PDT) Message-ID: <95d263d4-11e8-4b11-8cf5-fb3a3132187d@oss.qualcomm.com> Date: Mon, 13 Jul 2026 16:39:53 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers To: Baochen Qiang , linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org References: <20260711-ath6kl_wmi_scan_complete_rx-v2-1-22dc0f7f45e7@oss.qualcomm.com> <44c01b93-5538-4a81-ab5e-b25d0d56980d@oss.qualcomm.com> Content-Language: en-US From: Jeff Johnson In-Reply-To: <44c01b93-5538-4a81-ab5e-b25d0d56980d@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDI0NCBTYWx0ZWRfXyI5pcb/b2sxY eZcK2KNubVV2f8Abu30Kp5nUgCRUdO0NY0JjSTXbw25orNkza8z+isOCYf/yiTHbwcL/O6lvnBz PMeMzYnylho/tHGgdx9niRUpXMdOu2PTgScS06Bhv++050qeeePc0yjU6sUI/yoVETw05y646qP 6O4o7IB3H2GqDUme6HrNnwLWAhEe/teMr9ck1tlTB1Awa3CYYX0ATjnMUCnMVYDJSOOAUjLzR5N AWoX9npcVGNEvmB97iQuKElcdlVXEH4MKjJQnhhLLb3KST628+kVstokOyNI08lqh55vtaIhIdK okYRkLanWGYj5m0qGt0GSURnTdUcfQuh6+RIzUSLXbtrJymVXbt2aszPT9ewvjjurAKxQ/SNNFB k5N6NxGzW2EEOGdmeqx6IYmQRnHBNb2G5G1BGUtGgT26sMbA39jx1EKwbfNt9XCo3s+cw9oF0hD F1zZZszQB3kNmjTucXw== X-Authority-Analysis: v=2.4 cv=HJrz0Itv c=1 sm=1 tr=0 ts=6a55774c cx=c_pps a=oF/VQ+ItUULfLr/lQ2/icg==:117 a=6VQYfvmiyQ8t40WkS/mQdw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=KcS3GExwFv3QVkoieGQA:9 a=QEXdDO2ut3YA:10 a=3WC7DwWrALyhR5TkjVHa:22 a=FO4_E8m0qiDe52t0p3_H:22 X-Proofpoint-GUID: HEDvdIOwChZXIF0BEBT-MiOuvMoC4GOt X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDI0NCBTYWx0ZWRfX7x8qakx3yKAj Ielr7znaEA6AENdiOqiP6T2jrwb+eXeQeYTTHpj8iGIBucqB6mwrQmx1/s7VXqxAR6S0zdtSrbZ M7RO8wda0MENKmtJiWtrfFzyOo9JM5s= X-Proofpoint-ORIG-GUID: HEDvdIOwChZXIF0BEBT-MiOuvMoC4GOt X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-13_05,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 impostorscore=0 lowpriorityscore=0 phishscore=0 adultscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 suspectscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130244 On 7/12/2026 7:06 PM, Baochen Qiang wrote: > > > On 7/12/2026 2:04 AM, Jeff Johnson wrote: >> The following WMI event handlers currently read from the event buffer >> without first verifying that the message was large enough to hold the >> expected event: >> ath6kl_wmi_scan_complete_rx() >> ath6kl_wmi_addba_req_event_rx() >> ath6kl_wmi_delba_req_event_rx() >> >> Add length checks to prevent overread. >> >> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") >> Assisted-by: Claude:claude-sonnet-4-6 >> Signed-off-by: Jeff Johnson >> --- >> Changes in v2: >> - Added fixes for two more functions: ath6kl_wmi_addba_req_event_rx and ath6kl_wmi_delba_req_event_rx >> - v1 subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx() >> - Link to v1: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx-v1-1-7b11e5f8b96c@oss.qualcomm.com >> --- >> drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++-- >> 1 file changed, 15 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c >> index 72611a2ceb9d..08030d88c7d3 100644 >> --- a/drivers/net/wireless/ath/ath6kl/wmi.c >> +++ b/drivers/net/wireless/ath/ath6kl/wmi.c >> @@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len, >> { >> struct wmi_scan_complete_event *ev; >> >> + if (len < sizeof(*ev)) >> + return -EINVAL; >> + >> ev = (struct wmi_scan_complete_event *) datap; >> >> ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status)); >> @@ -3352,7 +3355,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap, >> static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len, >> struct ath6kl_vif *vif) >> { >> - struct wmi_addba_req_event *cmd = (struct wmi_addba_req_event *) datap; >> + struct wmi_addba_req_event *cmd; >> + >> + if (len < sizeof(*cmd)) >> + return -EINVAL; >> + >> + cmd = (struct wmi_addba_req_event *) datap; > > Nit: No space is necessary after a cast. This is a preexisting issue, since you are > touching, better to fix it together. Yeah, let me make those changes in 'pending' /jeff