From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>, Jeff Johnson <jjohnson@kernel.org>
Cc: linux-wireless@vger.kernel.org, ath10k@lists.infradead.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] wifi: ath10k: validate WMI header before reading it
Date: Wed, 22 Jul 2026 06:34:48 -0700 [thread overview]
Message-ID: <95e9a73a-c076-4bdc-9f1b-ba8a811f4711@oss.qualcomm.com> (raw)
In-Reply-To: <20260722042029.36066-1-pengpeng@iscas.ac.cn>
On 7/21/2026 9:20 PM, Pengpeng Hou wrote:
> diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
> index e57588c19c80..5b64b5f9bff7 100644
> --- a/drivers/net/wireless/ath/ath10k/wmi.c
> +++ b/drivers/net/wireless/ath/ath10k/wmi.c
> @@ -5873,16 +5873,28 @@ static inline void ath10k_wmi_queue_set_coverage_class_work(struct ath10k *ar)
> }
> }
>
> +bool ath10k_wmi_pull_cmd_hdr(struct sk_buff *skb, u32 *cmd_id)
> +{
> + const struct wmi_cmd_hdr *cmd_hdr;
> +
> + if (!pskb_may_pull(skb, sizeof(*cmd_hdr)))
> + return false;
> +
> + cmd_hdr = (const void *)skb->data;
> + *cmd_id = __le32_to_cpu(cmd_hdr->cmd_id);
> + skb_pull(skb, sizeof(*cmd_hdr));
consider following the pattern from my ath12k patch instead:
https://patch.msgid.link/20260716-ath12k_wmi_op_rx-overread-v1-1-327a4b1c2372@oss.qualcomm.com
use skb_pull_data() instead of pskb_may_pull() + skb_pull()
consider masking out the id here instead of in each of the callers
(if all of the caller have the same masking)
> +
> + return true;
> +}
prev parent reply other threads:[~2026-07-22 13:34 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-22 4:20 Pengpeng Hou
2026-07-22 13:34 ` Jeff Johnson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=95e9a73a-c076-4bdc-9f1b-ba8a811f4711@oss.qualcomm.com \
--to=jeff.johnson@oss.qualcomm.com \
--cc=ath10k@lists.infradead.org \
--cc=jjohnson@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=pengpeng@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®