From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B0C2357D19 for ; Wed, 22 Jul 2026 13:34:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784727297; cv=none; b=KWihfAsGBriCchFAclQIeVrz6BqdLixdTAgrtj93Aze0aEmvewVCqYiQlCnCajQRqDW/ceTiwtQjUBkALarazo0bMo8+B/BAUR1C1xD9YJAzUwED0AWG3t7abXBJsHkBnjiZkZ44z5a7cBri2bKfYDLC20nN1ZtmedgkEFjrH6s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784727297; c=relaxed/simple; bh=/C8IZwquBav2HFohCAi/UmibUN7UraiczymP5Xcssvg=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=jxOLQlsgkOE9zFcgvqXqTHYYFnOljJD+DjQBMoTlCLq2ayjRVj3yR9ivkT7AMsUecDw3iv03nA0dtLR2USb80Tnve/lMW3S6CxQALpf412pDLmoccwXnSIG7X8LPob+X/BcRqh3vqSXyIlsxX3I8mjgvp5wLF7OD2kogreVcDrE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=egJp5n+Z; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=iks3X4t7; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="egJp5n+Z"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="iks3X4t7" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66MDWjsb891992 for ; Wed, 22 Jul 2026 13:34:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= bAMC1tEWuW8aUIkhFhHZeU0Otkfs+pd7Gd9KHfl9tMc=; b=egJp5n+Z2iJ/qrQa ePIE5rzfZcfL/K4Pw/4v9nh5DhfLs40/CtFfi/HTea9ecA4rRyiho7ltyeXMsrB/ rhKjJGjxCVhuTwOEZHNIBWcRILG8OcNDsN/pNWwmtfoY2WAx6x3kkma4aCrXXyY+ Uqr2z0lzOgHW8XFfPw3GEtxzepKKdI8eIt5v2ddyhYdK7YLgZXuYLn//Hu50XGkF ZPPa8TRGErrNejPNhIwdAS2CUYrS2Pl57bXbglZWIX5sBCRTMERfjroJ9nPd6R4b fbHS8ByNgh8bsOLuSVbEuKr6/q+9k7u7zPnWgZ0e/3NihBS4OqiZPaGx3vAM+9c2 v8m8Yw== Received: from mail-qv1-f69.google.com (mail-qv1-f69.google.com [209.85.219.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fjxm102dp-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 22 Jul 2026 13:34:55 +0000 (GMT) Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-8ec45d9628aso171838776d6.1 for ; Wed, 22 Jul 2026 06:34:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784727295; x=1785332095; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=bAMC1tEWuW8aUIkhFhHZeU0Otkfs+pd7Gd9KHfl9tMc=; b=iks3X4t7eahP7ra+jJfLGxLIbsUDHmRhmlS1aB2KkfUFfbuAmEoITC08JC0POHLJkj hDMuX5PIPZHl0gfBgYA7iFFNGDIovyZgLAGaGjfBpkfTTrf3S/Hu5Z6Tnzyz/FA4xywP Pa5JGb0v2TgoRxPzAUjzQvY5pyUScK5cTa4E0+jBjpGPDeBgYxNZsKtK4yB9xjeQ2vIM uhwI3XhE5R9xSxupc9PbSsvkSqApJaR1BvKsJ2sgNK62GobYkmwZayY7QJxWmLqtQfu/ yRrTSvQvNlT9QedtS5ni+JVJeSP1qXuZeq/Oyd5mDt+8u4fWHlXU/3Gi6N3i8q0YeNEq HN9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784727295; x=1785332095; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bAMC1tEWuW8aUIkhFhHZeU0Otkfs+pd7Gd9KHfl9tMc=; b=Yr3hoI8KyQXpR99N21g6ZCFAw9cwt1ZhbdNI9wJTUATo9Zaarum4cpDW7ssYNs6Lzo Qzr+vQLaZp4pOj60EsCI+FRZeDQG6NUbWR6Pn5iEk26j4N1eslPAvlkh3yo2UFUHevB/ ERPD/OvnMrJ2dzoEVHe70PQkfbs/HQpZqPOn23iPO+vOZ/IJMPd1wXWLXme7qWxJ5sfV nHjzkOoD0g1rpBeWt95dLEJUn+ko13DhzrjL8b4HiI68vfiRNGMnT80cj05qCXff981c ek9O0NQTAprSevneUqDpYJ2blg3D+3KKEttmX91GyjFJly7yVdhmNX8N7j5x1p4DPxde Y21A== X-Forwarded-Encrypted: i=1; AHgh+RorOEqajWnDcswseCtoN1WJq+QdSMHdtnk8x885uRKENFoZJyH0BLIiqew0oC2ByPtqoA9qqsjotYmhoAo=@vger.kernel.org X-Gm-Message-State: AOJu0YzKM5SyWvVjw5TCqfyFUErBluj9kPyPHrXlZywmC4rc8VblLoQ8 dFsG4zSb0uVk/dCfo7Bxyz+FT1gnM1Qh5ZsOlHy+9q59e/KAeUgnIYkPW+D2TWgyMEMWgfG70m7 YKBurGHdMtVz/8g+gqJAnkeIz3MqdQgx9qZQccRALzm6+Ly6WiIBLj9dx0A9O1UDrdSM= X-Gm-Gg: AR+sD12/tdcyTZtwpE2TOE6mD2PHAKRop6YBbnXE3D72QJXkvaUbEkn2N+e8FzYo8VI NIKfJbY+jsXoyRsdPGt3wiOBxBk5zO8iu8gcdZnHlldW5EaOM3k951gE5YBp9TYZuVjcmOgdhDu s6vy58SOs9nT8pVdGrCuEE6hLsq5iwEhKli7/7F9aJDTHRyK9Elc6r9eDnRPjZ4IilVmxAtchd/ D1ma/DwyeGRuS9MV/1asfo4RbKaA3NhK31K9Moa9EmMMPBwvX972Usr0/Gil7V4SBb08Du9Am7N 0kIDUW4Tl4G3dyW5HFLkTGUNEHHJVyi4aHRou9JKlxh1JeTiem8cOw14wMd66oR5JLlNtzSCfDj iKy1AySL3ms7kDC6Ma4ttGeo/E5dHMMTA66/lzzH2AVIA1MMg7HY3lYYyCsC6 X-Received: by 2002:a0c:e084:0:10b0:8f1:ae38:1beb with SMTP id 6a1803df08f44-907783a0557mr191584886d6.32.1784727294600; Wed, 22 Jul 2026 06:34:54 -0700 (PDT) X-Received: by 2002:a0c:e084:0:10b0:8f1:ae38:1beb with SMTP id 6a1803df08f44-907783a0557mr191584546d6.32.1784727294127; Wed, 22 Jul 2026 06:34:54 -0700 (PDT) Received: from [10.227.110.203] (i-global254.qualcomm.com. [199.106.103.254]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-907baa0b7absm21266636d6.37.2026.07.22.06.34.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 22 Jul 2026 06:34:53 -0700 (PDT) Message-ID: <95e9a73a-c076-4bdc-9f1b-ba8a811f4711@oss.qualcomm.com> Date: Wed, 22 Jul 2026 06:34:48 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath10k: validate WMI header before reading it To: Pengpeng Hou , Jeff Johnson Cc: linux-wireless@vger.kernel.org, ath10k@lists.infradead.org, linux-kernel@vger.kernel.org References: <20260722042029.36066-1-pengpeng@iscas.ac.cn> From: Jeff Johnson Content-Language: en-US In-Reply-To: <20260722042029.36066-1-pengpeng@iscas.ac.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIyMDEzMiBTYWx0ZWRfX0x0HMZuJAlKF BXLRj1D8Qiwu/kAZZsRSMVcpYzcCA3FC13L2jO+PFBXv1NdOQZRLWyYk9KRZ5I9UMpEDAEeu7xg p8tat0RxUEDSc42ivmJmHkpPMdKe+hU= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIyMDEzMiBTYWx0ZWRfXyO/XIBZbcWA5 sJYSRfTII/k9WR9bYEgxCZyTe6M7VLTU2RFHLl6qpsP/4RHFh+vKy7eSVys2vDJ+LVM3L8Y8a3Y zoNcgVc83/fCRzlGSGmMT81auPGzst94G+RHke59r35YMZzOUbEC3c+kfOTBeHBPf2E+jpLabcn xXxftKPL9vePJhlpEGbvgGpoqzyXOr32Hbg980SkD1T5ip9dLVxdou2X3fKRmogQEuo6wi/OGt5 mda1tC8addItWcLSEJaQgzj65IPgoOnPpkFa1nhYmtoEMdl0QOxwZc18Rje2l4kh7H2h39oz+rt 1UceylaBPMXEsQg1mP8usE869wBJqk5HHHosmsl6+R6gmXJBt7MZtlcikuceySOeqFPd1EaMNUS KWEj1aX0SMb3ONm/JqODCqd46mudEbcAqvH0hJZ2B6/mo0XUH2clC1c0trEaFF/iKDUmmMVOEpp javsRH9roaWVEkfHvfQ== X-Authority-Analysis: v=2.4 cv=Rsv16imK c=1 sm=1 tr=0 ts=6a60c6ff cx=c_pps a=wEM5vcRIz55oU/E2lInRtA==:117 a=JYp8KDb2vCoCEuGobkYCKw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=PdpW-wIJrJljDUDkzOgA:9 a=QEXdDO2ut3YA:10 a=OIgjcC2v60KrkQgK7BGD:22 a=FO4_E8m0qiDe52t0p3_H:22 X-Proofpoint-GUID: ArCPqWGA7yRU-SargywHYno3gj25APlu X-Proofpoint-ORIG-GUID: ArCPqWGA7yRU-SargywHYno3gj25APlu X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-22_04,2026-07-22_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 phishscore=0 spamscore=0 impostorscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 suspectscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607220132 On 7/21/2026 9:20 PM, Pengpeng Hou wrote: > diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c > index e57588c19c80..5b64b5f9bff7 100644 > --- a/drivers/net/wireless/ath/ath10k/wmi.c > +++ b/drivers/net/wireless/ath/ath10k/wmi.c > @@ -5873,16 +5873,28 @@ static inline void ath10k_wmi_queue_set_coverage_class_work(struct ath10k *ar) > } > } > > +bool ath10k_wmi_pull_cmd_hdr(struct sk_buff *skb, u32 *cmd_id) > +{ > + const struct wmi_cmd_hdr *cmd_hdr; > + > + if (!pskb_may_pull(skb, sizeof(*cmd_hdr))) > + return false; > + > + cmd_hdr = (const void *)skb->data; > + *cmd_id = __le32_to_cpu(cmd_hdr->cmd_id); > + skb_pull(skb, sizeof(*cmd_hdr)); consider following the pattern from my ath12k patch instead: https://patch.msgid.link/20260716-ath12k_wmi_op_rx-overread-v1-1-327a4b1c2372@oss.qualcomm.com use skb_pull_data() instead of pskb_may_pull() + skb_pull() consider masking out the id here instead of in each of the callers (if all of the caller have the same masking) > + > + return true; > +}