From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 344DE3C4554 for ; Tue, 23 Jun 2026 07:45:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782200723; cv=none; b=EQj8+P1j6awyb/BogsvQStID9hjrV3cVXDMjbOn9zTm7HK0/OGg3tyM8ODz93+DoKuLV9gerom8hFNCQsj9TyKUzgR1AKemv4RQYTefn9VKEzZAp/IkpAv5n7Vf4LKfpPxwnvXFsi9Gy3XedwxliMSRKNVvlVz4BJcwPZA1/th8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782200723; c=relaxed/simple; bh=GRvgWLUvKNb4PI05oas0E7Wn4/28eX745Ht+uASHoXY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=giLCOSa28n6vxgM7kHNNqDv5ZP2oCjiR2HmSaAyEsxAXSU8cPlp2rdLu4SCIjujvRObVJ+EvdpVH2+OI3zRhp3HljC91ZCxcV7ha0BB75F9eXaEZpUqG15wXrJ/izHlOl3ryJctwGYm+XcUM6eTxHu9ne4vgMB66UNav0suhHm0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Um/hpA2X; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=hXyO4hVK; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Um/hpA2X"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="hXyO4hVK" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65N7j9qm1778166 for ; Tue, 23 Jun 2026 07:45:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 5k2CxQc0cgPN+CzLjN80nwmryJtF+WIcCnZt3WnvCqg=; b=Um/hpA2XAdXEaWsB aFulvItPCySl36Iiidtab+5aQkeaNu0koLW69vOtGdIdTj2sJZftB+OpmwXKNLhA 3edG2BJRPj/uxU8K51TAh+eMbIVnXZvi97psQwRZXqIaDhMr/VNCMbDKfnAjEkGx yrtKHxfawhkGeEDItEmw1VP8QPzaMRJyEM1LrboMWog3k8D6kHZxg9a1v5yFjhtm W4cGH8AutUmnW7C+1aOjIdUgclv5fgy+xqqbvNdqieOhIsYQnTv9Kwq2U6lygP8g i5qggdRcaUEWdUeLbLTYy1nonkJWGHFyHMJ7Vl/7RmbtH94uMmOG5bQyYIicHWHR viI55A== Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4eyp1gr00y-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 23 Jun 2026 07:45:21 +0000 (GMT) Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2c6a9bbcc53so55615595ad.2 for ; Tue, 23 Jun 2026 00:45:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1782200720; x=1782805520; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=5k2CxQc0cgPN+CzLjN80nwmryJtF+WIcCnZt3WnvCqg=; b=hXyO4hVKPI8Wihk9A5vPHmOldV0BsmtvGOcXHzYDDvmKJX4EsE+RdZy+3MXH2p3wDH mkEvghrv5DDX4bgbFdQX04rYSCQwyEARZfzbblTWRY7WxbA8wsdPKO8JypFe6gbovmtl 4W+vEmiU4W6URRXG/JoZVM3AI8LYL16g5hFcft7v+6kORbVDmG4nXsoM4onb6v7bHiI4 TqW+UhO5T2su8j1hgUpgI4PoQDtFBLyp2YBskUU98FI9f99RvIBJWy21kY47wAouTpcy P/yQuUmtnfu/y6r51iZqefoFx+4sbWzn2zWG+O77hHVDFRg/nWcXTOKFJJSs/KN1lR0X OXnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782200720; x=1782805520; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=5k2CxQc0cgPN+CzLjN80nwmryJtF+WIcCnZt3WnvCqg=; b=R+R4hjeSK/zp7IBVujldGHh8igfkBi+GQ8nVE5Z7MJ9wR/qeSix4Y5vGLUeKY8T9Px vHssO5Ns4xYB77dAcbh29ts+J4JS19MAcQ3QAtwuN0SSxkhdlBPJ2Ag0IAWnzIkmM9HU hMd39vHiCocieiDh2hW3tLH3lVupw6Wc1Z0OrCpY4pBwKGDLtzx5cakXzuWIhNrF70Z3 zwXybZ9//EYDaYObJsCfg0anMZG7d0cvExoZx5QF+4p0Vx5irO8HSVH7msiFDI0Y+S7v uDCJ7nedx2f7nM5bTxukKxD2upNXP/k3h5UicNh4wCI8RiKpqKj8Gl1hvrzyXCHMuvHM FXlA== X-Forwarded-Encrypted: i=1; AHgh+RpMBb6cSszkANf8aOp0JOCxueMG7P17sHyXTHXmOaKB52nfPSaQbuhr9UEoqTE98lh098n5SuXgzSg9WDc=@vger.kernel.org X-Gm-Message-State: AOJu0YyCq63Wjo0OyYlcXSWBWeTWhHdbnxqPzOCvMXllrig5t3jRgpq7 iu0zoqVr1+4GbSYgHqjfpI1W7QN4MJi+B6ii0BHQGvWYdk+Rdedh+U8ZEN8FpJWYR3u5t+Eb8+O UxlJQwmjRC2i6piOk2HQBpaaKDhS+NQEf338eNtt1TvfoNcyfcFKYv0JPC0jCytjLrig= X-Gm-Gg: AfdE7cmylvJzOiM1VIXKHz8zgtjYOrtw9umS4jN47oIhi8yf3sEQCxTEK7fcwCuNLRM WYed3E/wMUgzXYm5Mumcu56zPi2eB+cA5hX68eVYFiBacUlgaMf9/ed6h6yN4V6qaerAipT89RM EBNFWIUC0AmaW9NfJrNEcUEzSj3Eft4ZyjlTiCQYk3DOdKP3YJr/WV2My+L2J4CvjSx+c5EY+om kRrpQzKuVrhwQ6ldbCLGvM4HJe/rgU+/5DLzZSkubNlhTY8k8VxnDmZO3fUMniuEae3ZJAkZxoG TMzrabk67aY2qy7KesOTXQ3Ie7E1eft+FSjBvTZ2/c7atYW5Smrz+yOOJnRpIOcT22mDAS0nFlo dOOy/kUJ8eqB3Q13c4ZAMWLhqulrpoC+HGWXtJWTrHvGZwwJVsCYYeq4KFoAm X-Received: by 2002:a17:903:1d2:b0:2c0:d2a1:70b9 with SMTP id d9443c01a7336-2c7186010fbmr197447045ad.0.1782200720556; Tue, 23 Jun 2026 00:45:20 -0700 (PDT) X-Received: by 2002:a17:903:1d2:b0:2c0:d2a1:70b9 with SMTP id d9443c01a7336-2c7186010fbmr197446765ad.0.1782200719984; Tue, 23 Jun 2026 00:45:19 -0700 (PDT) Received: from [10.137.71.130] ([106.198.36.229]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c7436ff46asm102538555ad.35.2026.06.23.00.45.17 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 23 Jun 2026 00:45:19 -0700 (PDT) Message-ID: Date: Tue, 23 Jun 2026 13:15:15 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 2/3] wifi: ath6kl: fix OOB read from firmware IE lengths in connect event To: Tristan Madani , Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Tristan Madani References: <20260421135009.348084-1-tristmd@gmail.com> <20260421135009.348084-3-tristmd@gmail.com> Content-Language: en-US From: Vasanthakumar Thiagarajan In-Reply-To: <20260421135009.348084-3-tristmd@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Proofpoint-ORIG-GUID: CpAbBieelEDvHx2PO_aqmdAKAfShlicC X-Proofpoint-GUID: CpAbBieelEDvHx2PO_aqmdAKAfShlicC X-Authority-Analysis: v=2.4 cv=QJhYgALL c=1 sm=1 tr=0 ts=6a3a3991 cx=c_pps a=MTSHoo12Qbhz2p7MsH1ifg==:117 a=6/2MXK9rXRWb21GBy9lArw==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=J_-Nd1mkAAAA:8 a=EUspDBNiAAAA:8 a=rS5lWQ6Nk58PToP3HakA:9 a=QEXdDO2ut3YA:10 a=GvdueXVYPmCkWapjIL-Q:22 a=n8ForQn92ZFaZtFqRdMw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNjIzMDA2MSBTYWx0ZWRfX7kjSXl3+tOIH pzdDrgmH43plYRqlp+NIxF3cZkrvjgxkKJu6UT2SQBSD2408bilbOAFFWjWShu9vplhIvXsFXPM TqsuIqcH3WDgyUWitbxWUs78btYT7cw= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjIzMDA2MSBTYWx0ZWRfXxNLMVLMAUDqj Yp8gNoskwNHy8XPFE2YAPhznjTdtovVelYY34sQ23Muwss23YP5mqB3cduyzsonf2FQoKzBufar t2Er2bgGuI0pcwft7yacU7XBzMR3pmKDW7u0/As+hWczkD9kKtIAZ7biqjNie8F0nqmJEmuaImL yfE39T3KjFOtUKrpr3fx5wU9OMp0aqAIlZXDCsInKQjYp3EOgn1jHvWI5/Yu5aC1kOQ/mKJ7hKn UTYdECYU7fXmGrZk6dAevUCq+wkVfb60gRdqBMrLHWahTWpX3U8cVB09wygkGwjUbfj5Pq86cDI sAMW+qZe1ptsBsjfq1wKyyQ6nNUO3Zj7A+OiU8QHC0lF80WN5Pk4Q6J4wCh7OHZmd1SIfR+z3mb F1KINly7b4LwAonhjWih0MlUUCdRfDDr72FZNswqBzwSpO4Kaz3x7y7tZaYZCpzb1xuE5tBuoPL 1nzjbEM+W1DRI1M9Rxg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-23_02,2026-06-22_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 impostorscore=0 bulkscore=0 adultscore=0 suspectscore=0 lowpriorityscore=0 phishscore=0 malwarescore=0 priorityscore=1501 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606230061 On 4/21/2026 7:20 PM, Tristan Madani wrote: > From: Tristan Madani > > The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len > fields in ath6kl_wmi_connect_event_rx() are not validated against the > buffer length. Their sum (up to 765) can exceed the actual WMI event > data, causing out-of-bounds reads during IE parsing and state corruption > of wmi->is_wmm_enabled. > > Add a check that the total IE length fits within the buffer. > > Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") > Signed-off-by: Tristan Madani > --- > Changes in v3: > - Regenerated from wireless-next with proper git format-patch to > produce valid index hashes (v2 had post-processed index lines). > > Changes in v2: > - No code changes from v1. > > drivers/net/wireless/ath/ath6kl/wmi.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c > index 72611a2ceb9d8..1cafbac2938fe 100644 > --- a/drivers/net/wireless/ath/ath6kl/wmi.c > +++ b/drivers/net/wireless/ath/ath6kl/wmi.c > @@ -862,6 +862,14 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len, > > ev = (struct wmi_connect_event *) datap; > > + if (len < sizeof(*ev) + ev->beacon_ie_len + > + ev->assoc_req_len + ev->assoc_resp_len) { > + ath6kl_dbg(ATH6KL_DBG_WMI, > + "connect event: IE lengths %u+%u+%u exceed buffer %d\n", > + ev->beacon_ie_len, ev->assoc_req_len, > + ev->assoc_resp_len, len); > + return -EINVAL; > + } > if (vif->nw_type == AP_NETWORK) { > /* AP mode start/STA connected event */ > struct net_device *dev = vif->ndev; Reviewed-by: Vasanthakumar Thiagarajan