Re: [PATCH] wifi: ath6kl: validate assoc info lengths in the WMI connect event

[Jeff Johnson <jeff.johnson@oss.qualcomm.com>]

On 7/13/2026 11:18 AM, Doruk (0sec) wrote:
> On 7/11/2026, Jeff Johnson wrote:
>> Some aspects of your patch are already addressed by:
>> https://lore.kernel.org/all/20260421135009.348084-3-tristmd@gmail.com
>> So you will need to rebase once that lands.
> 
> Thanks for the heads up! One thing that looks like it may remain after
> Tristan's patch, in case it's useful: the aggregate check bounds the case
> where the declared lengths are too large, but ath6kl_cfg80211_connect_event()
> still underflows when a length is too small. It does, on u8 values
> with no lower bound:
> 
> assoc_req_len -= assoc_req_ie_offset; /* -= 4 */
> assoc_resp_len -= assoc_resp_ie_offset; /* -= 6 */
> 
> so an assoc request/response shorter than the fixed offset wraps to ~250, and
> cfg80211_connect_result()/cfg80211_roamed() then treat that as the IE length and
> copy that many bytes out of the small assoc_info buffer to user space. That path
> is separate from the aggregate over-read Tristan's check covers.
> 
> Happy to send a small follow-on clamping those two subtractions on top of
> Tristan's series once it lands -- or Tristan, please feel free to fold it into
> your series if you'd rather keep it together. Whatever's easiest for you both.

I've already landed Tristan's series in ath-current, so you can base a new
patch upon that.