From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C54122576E for ; Fri, 17 Jul 2026 01:58:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784253494; cv=none; b=ikYddUh7HdXE0OP6XsFxZERX2YsflWQYJaWC3EICcbTcmucruCX2wck9R02tmwYDPPBbMUAfRZFT7TscIU14ACz3cmnb7i7X13vl3z/H2JcBDWcLDp4640WoylcKNOZ9p/TQZl8b4Ibnzm1QVYpxBjGyaE7Wtnm068X3hBQ0piQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784253494; c=relaxed/simple; bh=v86g7JOX7V3wq9EtD9arBH53JUyZgfW1S/mmdwXfHcc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=P4TAGDDHfboyLo9q7aoZsFRAaytPvOKov1d/7SRa5rSdqcUrzCMpaogCKU9XLUtKdotnp4XiCFYbAG0Jqm0meAHeHiUp1AOSq+YgNV0b2JWBCk5tG17t7mM9KYWpGDVKt8ovW9Hn6o/Gpl80yxHznuhsTAGyJRpz2zfQyLKGtTE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=ofiaQ0b2; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=GApuuW6m; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="ofiaQ0b2"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="GApuuW6m" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66GNIqdn119589 for ; Fri, 17 Jul 2026 01:58:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= NfMjdix74msaRvIWwfm+9FyHwm1EorjtAesSIN9caMc=; b=ofiaQ0b23QEAtgjg ovVhtbb6ZHiidNLCobEzdpu9mftmD9sKTwJu7x+NSpJyiT2cePajCa7P3BGgZlFl 6I/NWuEbWoKdDC0VnYvqVgoH7hGm/gIx8r/IBNpMrp9bqhRbK5gDNIT0wR/tzlKE isq2DbDUm0KLLfATdjP6mHUzfrzETXWGFHquq2G06a1vUL/4ULxfxeVYEDRyIOEr IvcA8bAM2a2jCFzuq1eGql0vyWEdnRhhXxv51vZnMYWmMwomLdmwWZX3dYotrUyp wosZ1+jCs2ZQh1jiF2xDtpKMjN4O7Wt7oQlCAYuJWdrPYKK9/04Q/m7DWZZfyqh9 QtJ/IA== Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4feu10c61w-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 17 Jul 2026 01:58:11 +0000 (GMT) Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2cce14a21faso20543125ad.0 for ; Thu, 16 Jul 2026 18:58:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784253491; x=1784858291; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=NfMjdix74msaRvIWwfm+9FyHwm1EorjtAesSIN9caMc=; b=GApuuW6mptqv4Fb8E+iAxzzaVe2wRmgFYeeKNeRaEaVrQK85qUYCO5OKub/BPJPuvh afpM4puqQPeJn206DMBExJPv+StlbwJlr6he5HdpJZiwfYPdpC29Q0Z28LG5TZDZ36U5 07iKLCtqZrTF28S1+M1Gr3ZRJiFDj+cxdvXt12h6eOjzx7WnP764V1QMtijU8xXYIita 25HzP1zXzw/0N4XF8iZaXHvjA5Gp2ZUcPuHiXGl9Z+8sMWWbOmsmYND53FdFJoWLMApC ulunsJDQpncDjQ0x/wOx9IHp2g99IhEVicrMZkhByV3VcTYC4N/2V1TYX3Ej9xhaaZrP 0y2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784253491; x=1784858291; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NfMjdix74msaRvIWwfm+9FyHwm1EorjtAesSIN9caMc=; b=jisAhbBRQKOf1R8bR4KFA8NvSB/wtrgUWcRkdSJsddBewTs+oeZdGp1TXIOiMuaIz7 5peMsvLbJIusysDYZgwDiA/1sjLzhUaEYcKHM/vVMF2HeNDzv9ZjoTDyYOwxx9r0zw4N Lw0VVO77SbUYCiHM4vZrQ/tbiLBLnq2uxfmGf0HbWgUY2YJIko4CujNQdzA5G7VV4Sd9 O6ZRc4nqeR8GTHhVrbGx8VnBbb8Boci/6vsMC6KugZeI74csfRiP33SCD4sqbKR+nrFv ZEYViH70ibcO+qCIAT/7nv/kVZQgg0IFZjxkRkeqpSDu+hbd1ZV59/zxnrVvNmAYuU5I wQWg== X-Forwarded-Encrypted: i=1; AHgh+RocCCUKg6OG9oOkBxg4PIvQcAXpScY6BcNwSTKpPZmugkcgdTlOF/1gt2mJ0rDsu8z31fR1pgUSvYVheDE=@vger.kernel.org X-Gm-Message-State: AOJu0YyTIScws255bNHk6XN6a9SEA+gevOg9eGZp9a5z9O/SgfLgoT6s ubI/mKVTw4bdoe8usu69RxbciT/WOz0sGTYYGdYYiWe6GrIy16hiIucCYkoIO/KPWJ5Hh8qLmuP oAeUiSWhJtMHLRPpY4iDNw3jD/qgcjtehMsYNAQiTKmGp9D8YxekS82esA065/kLG0Do= X-Gm-Gg: AfdE7cnHWS/UlZldVzVn5Z1BofvVwVsD0HZOQo6dgSXEnUdkqQ6oXKFejQb+Mz1vkJt vEUiudrQJbSKMOyL4Fc+z8Rdj1UW7yokEPzxXPWGyQbINkWI6Fr++jk2dgMWbLyFg1oXNtovxMf uGh3E6v8V8g+HPIWxhYxNrhcaGJPaEMidj8cX0ua1kA7MDDRgCKYOp1kOUETtmGh0o2tp3Kuz19 K4SBIp4UEkQQ3Q4UzDUcr437ZjwosXzWjN+d1LAnDkMxdHV4rGeI7SiEQLjzW1GkPxEaOAvOSg8 1murXP2YEKtPjL4Q+JXE+kvSUDugLrA5My8IObmogBgDhoGtlFF/HqvVpxd0f7c96x+qvU3b/ch 2QNxkP+VoD2xiST3rx534QDGVV+CU5x69vvvgy1HKxPFxPcA8RXZpIe/J7H9S9cw0rdT/a2Q0 X-Received: by 2002:a17:902:ea10:b0:2cc:ac15:ff4c with SMTP id d9443c01a7336-2cf1f29ea6amr57108295ad.8.1784253490755; Thu, 16 Jul 2026 18:58:10 -0700 (PDT) X-Received: by 2002:a17:902:ea10:b0:2cc:ac15:ff4c with SMTP id d9443c01a7336-2cf1f29ea6amr57108085ad.8.1784253490323; Thu, 16 Jul 2026 18:58:10 -0700 (PDT) Received: from [10.133.33.98] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf34713fe1sm1858275ad.55.2026.07.16.18.58.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 16 Jul 2026 18:58:09 -0700 (PDT) Message-ID: Date: Fri, 17 Jul 2026 09:58:06 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH ath-next] wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() To: Jeff Johnson , Jeff Johnson Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org References: <20260716-ath12k_wmi_op_rx-overread-v1-1-327a4b1c2372@oss.qualcomm.com> From: Baochen Qiang Content-Language: en-US In-Reply-To: <20260716-ath12k_wmi_op_rx-overread-v1-1-327a4b1c2372@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-ORIG-GUID: PCFk9nGUZ-tI954ipsIL3y9XUrUndvYB X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE3MDAxNSBTYWx0ZWRfX3KvIPF7BxGXO U2mYItAM8njn3iV/icm3CO0EIvIzfD3OmGXWhZHvT7MzsXNrj9soojLXwyAkb8xokK9ChjlWXIu JYBNYBj4/uGvqspPpy6BNoWySmm1+wfQL8X7O9E2KhgPRfqhPNia3X+vhTwXv1N7ACSCfk6DOnK CPN7SwLQutSp8IqLloshWdOntg6wjJBAojAgl5fcy1aqcezrCDesxeo44wRlEEz04kaD6Zq3rM4 iNcjmnd6xqmRaLZUrfjSbMwlFfdvZCFjmHI5IGbTOXK6UwMAAhrHQJfW0E6q2DJxNfNcbva3WKW 0hEu8gcDdgprsvCphV9P1ctiK8+JZKFL8o2BE328ktgRdvVKZCMm8w2ZpfYW+fJLnUvEFo9cqHN ReTopyuuZmjp5k+tt/2Drvm99ucGI8XneORFXXYWy6CXSUpMOE+DC0cmIYCvuLvuP1bwFMyPpUy V0LTRAmCWDI8ySpZdQA== X-Proofpoint-GUID: PCFk9nGUZ-tI954ipsIL3y9XUrUndvYB X-Authority-Analysis: v=2.4 cv=BPODalQG c=1 sm=1 tr=0 ts=6a598c33 cx=c_pps a=MTSHoo12Qbhz2p7MsH1ifg==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=EUspDBNiAAAA:8 a=ymRfW-ZP9UeHRcWsrQ4A:9 a=QEXdDO2ut3YA:10 a=ZXulRonScM0A:10 a=zZCYzV9kfG8A:10 a=GvdueXVYPmCkWapjIL-Q:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE3MDAxNSBTYWx0ZWRfX/yz+ayOz/2/C 9/mSxwZEbg95Acyzf2oWLYyxn09HuJvrNs1wV5M5ufqO906xtVyLM1z6fHuMyYXkkMX2ComFOya yOPbLWCje3YduYBQKxevFLWaqHBkkTg= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-16_08,2026-07-15_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 suspectscore=0 lowpriorityscore=0 adultscore=0 malwarescore=0 priorityscore=1501 phishscore=0 bulkscore=0 spamscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607170015 On 7/17/2026 4:01 AM, Jeff Johnson wrote: > Currently, in ath12k_wmi_op_rx(), the firmware buffer is read without > first verifying that the buffer has enough data to hold a header. This > could result in a buffer overread. > > Update the logic to verify the buffer contains at least enough data to > hold a wmi_cmd_hdr before reading from the buffer. > > Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 > > Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") > Assisted-by: Claude:claude-sonnet-4-6 > Signed-off-by: Jeff Johnson Reviewed-by: Baochen Qiang