From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1411D2745E for ; Mon, 13 Jul 2026 19:21:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783970511; cv=none; b=ej/hYoBG8UmQrLkP3LY2OD5YrE5/z1wIY4oZgZSjyMh5+HF8Ht7KTtNV7jG+5QtTF6s+r7Tz3jBECVZ4YBSpJCkNPrgnc4LnRaDwA3uULjcjSkYfkwtUQCV7Ot9zBROfRaQ/CMvYwdaYfZJSaoNbf71YFwqliHSGicOdsiWxEkI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783970511; c=relaxed/simple; bh=6LhmMs6hd+KSZYCGAq/TMAbEdTqYXcrYq1DH/orpYdU=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=ndhoSQ2aWmfOHo9GSaOwQzWw7w34vWvsgJ65Y0OFhpJ7xyzKWeZyjesMEf9pbcE6pkaKTPtQX8c+mdut9icZ7yaECG4qTQs10MXDUmdG7SeBxhkpO63O78PS+2M6zP7iCb2tmlwt/3SQsrz1ryD/bL4FcOullLfyf+a6QAk/0mc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=fKrvpY4u; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=cvnEZyGW; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="fKrvpY4u"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="cvnEZyGW" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66DJ9ZuK2389600 for ; Mon, 13 Jul 2026 19:21:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= gv0EQ18+ZmfZit6oXwIeJv6aQcSqfBZoI0pZMq+t6LE=; b=fKrvpY4umBBDZcYc LnpopDJ4yAtfDAx/r8fwdN2y41K+ntfE6biQocPvdCDTjewXd7phctPYfB9dyECj quTxy7q2mSAogXu0sG9oAGUE1vo7ciRlLx2i00DxAuKd71lFxM4wWCFhSzaMfz7P G290R1F1eWf6Rygb9MM23yXV+aSIdf5Lc21012vNQxjRwMxTr0yo05mZokUjXqYF EJpgbWO4PK3OHUVrKYTAjF+Qyx9HJHlCn9v+VMpdjzhgP6z0rMEeyrF1AVEWITFA OCMHLckPX/XT/Ac4GNLcP7ffz9hisEK7oPKrjXh2oiqLc2S4p7uCLv/WorC5KoEC 2Iet1Q== Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fd44j0ha7-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 13 Jul 2026 19:21:48 +0000 (GMT) Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2cec4226c70so26946845ad.1 for ; Mon, 13 Jul 2026 12:21:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783970508; x=1784575308; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=gv0EQ18+ZmfZit6oXwIeJv6aQcSqfBZoI0pZMq+t6LE=; b=cvnEZyGWL+OlbM84Fabx5tWefvDdgE2JMjlGj8W72/wZ95jXpF/KH6syjtcDWSPWEn UpJraua4h87GpzHwNaqQ8fB9T9dt1VfNgukmdGYKXA6wxrg2P9jXHvvIHSY7C5v2yZiD EY9Ok/YvWsvplGBwrZHkBaBtXkqgoYYrHOYaR/RwHz8W/OymgKi7/IAKTEwDo3GM5wFM uhsexK3DzZImTWtPIrpF474HAZJVv/zw6Z0zvKSm9lLWqPhGEQm4DvJYU+nxgm96yqtN zROJQWcGlhYeOeAz8lW4VV1dZQjnuhgmK6Z4gukJESe1QR5cuJnbTgN9iHqgNPKiJOYY wE6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783970508; x=1784575308; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gv0EQ18+ZmfZit6oXwIeJv6aQcSqfBZoI0pZMq+t6LE=; b=nHUz5YlayXlNH9eFNsWxv8p54TAz53bBvqR1izlcCrBE4RrMmxeX0YMGkwNwqihI+W NNR+NEUk6jrXXxULQAVlneldfi0teHoq3NwhoByqZAdOx4oagum39eJbhhZ0EIY+oipP PXKblYbZESpnQ1q/I5e1nP6GxVod5uTFd1bl1iXXfbQ9qUXl+Wo8muW+AUb/+DiGE6wM MjbQDmtk4slaP+G9JSdAa7OoiMEyffSdme4As/SLEBynEhK3EpmO374srnPoR7A5kXkx o6tZwFX4DSy5Mrsy+GpnCMrWM2jFTDUAA5+EM3to0wbHIS11CbUvPvj+MASq2weyMjLj wz8g== X-Forwarded-Encrypted: i=1; AHgh+Roe7gqsVISphgAk6A89OI/qhJp1s6JiYF7km0FDbt90CDrVG9WmLw74i7aMOJkzRqTzVJYqNI9tVsLnkcg=@vger.kernel.org X-Gm-Message-State: AOJu0YzKQAEJ34Yo16iEWnoVfpgWh4tTo/NDxqDQPFXVrXFtyVBrFAn+ eHvMnuedwrgIDNv2zPIuJU8oFuGGLNRVDEaN+dSpBEQFDsaAZBmjsS06lCbkIkWtBc5fFt2VB0k RnoluDH12jk4i2C8Ujj+PlJAZEWn3i8P5+7Jv1SsAlU/s8t4zJrzsXYLavBLss6GE7Lg= X-Gm-Gg: AfdE7cnlQUMP2MG51lzsRV0vdJ8UG2YMKrLfpjdXkX53ukWjpR05DMJKdOmCRKZgVV6 w3eUOpAgMTAbJgEgBXuSyxe59Mh0l92iZ72GHGOR0fFtaXviT+CCGQ8HFrX1+8Zvw2sXStv0NkH SnKvplpTsPfYogmH3JBC7kzoSXl7xANrWRXyeweHAWE/8UrJFpxpd4oan6oIpTmeTAPUVBZg0Mq Mepy8MsNqPdxdjtuK8w9xl3VPqtCmuy/4G2qX6k3IH2ctfCAF9whia9JrbDr40dOh3LYdrwVodv Iph5LeHhqA48cWb5JwZXdtYxHskE+qK5NearcfSkY1QepNc32erXxZdl7ENpXLACdYpE9hvnhKG tgHJsY6A1SvmC8egRbbJbt4lRpF4t5JdReqHniQfJpa7PU+SCiH1EnwEL/2YZUCXiNdv0 X-Received: by 2002:a17:90b:510b:b0:387:e0bb:57f5 with SMTP id 98e67ed59e1d1-38dc7798fdcmr9489008a91.38.1783970507912; Mon, 13 Jul 2026 12:21:47 -0700 (PDT) X-Received: by 2002:a17:90b:510b:b0:387:e0bb:57f5 with SMTP id 98e67ed59e1d1-38dc7798fdcmr9488989a91.38.1783970507346; Mon, 13 Jul 2026 12:21:47 -0700 (PDT) Received: from [192.168.1.11] (15.sub-75-218-246.myvzw.com. [75.218.246.15]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311a6115e61sm55950750eec.22.2026.07.13.12.21.45 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 13 Jul 2026 12:21:46 -0700 (PDT) Message-ID: Date: Mon, 13 Jul 2026 12:21:44 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath6kl: validate assoc info lengths in the WMI connect event To: "Doruk (0sec)" , linux-wireless@vger.kernel.org Cc: tristmd@gmail.com, johannes@sipsolutions.net, peddolla.reddy@oss.qualcomm.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <20260711071336.58324-1-doruk@0sec.ai> <779ee099-5132-4752-bdb8-354dfdc53926@oss.qualcomm.com> From: Jeff Johnson Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDIwMCBTYWx0ZWRfX+sWoBJPyxSrG KjkFAYnjUNIuRAT8nN5HRetbHPyodowNYC+qeBMhNDIyb84qWnieNxLegxsz0iANahykxufUzLA c54Nh8MMX33gb+FPJlnxRkUtUTrbGnU= X-Authority-Analysis: v=2.4 cv=N4UZ0W9B c=1 sm=1 tr=0 ts=6a553acd cx=c_pps a=MTSHoo12Qbhz2p7MsH1ifg==:117 a=6VQYfvmiyQ8t40WkS/mQdw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=PVemK8KFIP-Ydl4GPKYA:9 a=QEXdDO2ut3YA:10 a=GvdueXVYPmCkWapjIL-Q:22 X-Proofpoint-GUID: YFz0elJVtiln_JMaad4UUMpkj-4HWIJW X-Proofpoint-ORIG-GUID: YFz0elJVtiln_JMaad4UUMpkj-4HWIJW X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDIwMCBTYWx0ZWRfX6R8QZuquvAqk KkmGTZEE8jbk6XRJlKLHfzK8WtXSnQRpuy72WOoGb510umtLZ7Be0/WkECFAl2iSIcDKZTVTg4K ZtgdFlQBjCIvASYfosSSL2ubBV29mGMNe7DRuht7v9Mmd5tDPeXmM5HAuLydufzEjOC1Dzefexp 0b3ltfiLd0Plwt9HH0NgEQ8TGgsGd7k4At26JANVd7Iy1jaVTyazoYFOh0AblReezQKcDaQgoz+ glAitZrYfP7Em1Q6lCPiMWsYqZccSJZKiarYx9cD4GJIYAQNdviBZn0hzFZqRn3mKjHj5VsvlBK jahtNiCLXUcN+wTlKdVLN6Vzo/8z1sbHAafb2ZqErdZHMPoQHXacKVNi1VhvoqLndJkJy36wBcj +5idAGeBheS/zuGUvdbvHhq0F9ZTMKP8uDk4bKfcs3BYpWoM89yqjzJDPOH1uWJGlVYn1/p286W 25AIGfwoo3zN7nv4Lzg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-13_05,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 spamscore=0 phishscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130200 On 7/13/2026 11:18 AM, Doruk (0sec) wrote: > On 7/11/2026, Jeff Johnson wrote: >> Some aspects of your patch are already addressed by: >> https://lore.kernel.org/all/20260421135009.348084-3-tristmd@gmail.com >> So you will need to rebase once that lands. > > Thanks for the heads up! One thing that looks like it may remain after > Tristan's patch, in case it's useful: the aggregate check bounds the case > where the declared lengths are too large, but ath6kl_cfg80211_connect_event() > still underflows when a length is too small. It does, on u8 values > with no lower bound: > > assoc_req_len -= assoc_req_ie_offset; /* -= 4 */ > assoc_resp_len -= assoc_resp_ie_offset; /* -= 6 */ > > so an assoc request/response shorter than the fixed offset wraps to ~250, and > cfg80211_connect_result()/cfg80211_roamed() then treat that as the IE length and > copy that many bytes out of the small assoc_info buffer to user space. That path > is separate from the aggregate over-read Tristan's check covers. > > Happy to send a small follow-on clamping those two subtractions on top of > Tristan's series once it lands -- or Tristan, please feel free to fold it into > your series if you'd rather keep it together. Whatever's easiest for you both. I've already landed Tristan's series in ath-current, so you can base a new patch upon that.