From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92992305667 for ; Thu, 18 Jun 2026 02:26:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781749597; cv=none; b=IOpo6a1y4I8ZtZ0zQepnSs/uc1k7ixT0yO4FEnWr1ESMabyUvCeOIrKycAeQnurfKHWJgAt6b5AjR7GiAZH/wLdxjGOsbEuShpzRrch9JEt/hUqXHur2eHbTCpeAwCyjWLui1QsJj/FezEPYmxtlYXts92sgsAih/749NPNr4oA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781749597; c=relaxed/simple; bh=Kxw8kKOKrRDyeLtmbzCsHduldjoxsLNr2BKRzB6zIh4=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=C5N/4nhKRSGndI1cnAXpy2FSEpAOnMLUSLJmvaux+k155vssdLBRa2mJGvc4Vh3/7i4UyWecPh5UBDUTu1GRUASNz5yVRtRBKgCcfvw7rT8X9kg3QUScmzsKMX1gF1xX6V4pJLbCG+Vd4G63JgV3tplADP0lAKKfBLEms2Ej9mo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=ZJVfheDE; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=ZHkEVhcE; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="ZJVfheDE"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="ZHkEVhcE" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65HIse383068299 for ; Thu, 18 Jun 2026 02:26:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= zKf0bmfDYppgB0e27FIJ8nukk3QgDh4nPI/Bw4DM2ng=; b=ZJVfheDEmc1IaMDG ZWacjI77NF1T8N8z8ShRjm6O0OL5IHZDXPwIUjsaz3TfPB30onNI7ocY7XmhHlIr CtQIhE9AtFthPO1PAPbYfup8q1CGVgc8YlNWgErWSQ1ElbWHjRphxO6MiVeg8Yjr 2yB2kmJ3WntRwwzfVH5pURl2WoH9WsvnLIr48bSQfY1Za7At6wB+4s5T8piTA93m T7u06HmERQcNmwHEk5Y+ToGJ6IOyGtnF9NabQodbS2pc/IFPzq9SSPwsUz7DuX4i INeL5h4QIStcDJs0Q7IUdU6t50pRa+RqIWfGkjI4FyVnmK9+9o9csHJGABGo9rj1 ERZqMg== Received: from mail-dy1-f199.google.com (mail-dy1-f199.google.com [74.125.82.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ev199hah8-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 18 Jun 2026 02:26:35 +0000 (GMT) Received: by mail-dy1-f199.google.com with SMTP id 5a478bee46e88-30bcbb34e57so726402eec.1 for ; Wed, 17 Jun 2026 19:26:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1781749595; x=1782354395; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=zKf0bmfDYppgB0e27FIJ8nukk3QgDh4nPI/Bw4DM2ng=; b=ZHkEVhcEEEu4rFcmGpfi+DprApqzP+MYVxLWx6p5x4fpfroo/bwelSGaN6TcsoQ3NZ thcnIWsHUFRNWrcjB+5/DR6lk0j3MXHbmbDq7nOx2PUOb+7aRQqhmQHVUydG8Hu6TnxF 9+AgDeG+joH2uQwQuOtgXgaZrL/QVevVdhh/9+1XuUBue8xVovtnd0MfRoBogyie5HnY 36CFw2PteqlaCxj2Z917tMOdGPoL6hC4MCM/ZS/CZ9XtViZzxSB8abB2IrUGAhOTNc3p 3PKom53AMuws8UKz6EXXlRNaiH2Sl1hmNqFgMYj6Z0jqUmZLjN+v+w3pvTzLGx0n8I9o pNww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781749595; x=1782354395; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=zKf0bmfDYppgB0e27FIJ8nukk3QgDh4nPI/Bw4DM2ng=; b=SQI/LczA7lt4R7Q124OP8o4Aou0+i8PVa0Ybwx5K3JDLviDesnhI0OUJNkSTyANDmN jHWX2KAVG4qk54Q8uC7qqOk/shF8PwlU/NyYSfRIKLkFq1PpERAe1UWLXJh6PR/53bYx t68MRykzy6Cz1gDIkUyZsE3vrYyOGbNoOoHytJGz4TlEgGrYtTS0+BOijpG+WRZYY3Dv h1vZuEqPDgxeWVdAxQwI9hv67+HjYJVxU1WcrEnH0qCR5nDZnedUhjUnlZBNCyiJRprZ KoDGNNuelY3fxNhPolJk3iN3VkUgCesxHKK93mb9hnM/I0E8pY1k6YPUjis0iM5urTlL R2LA== X-Forwarded-Encrypted: i=1; AFNElJ/PVEtfp8hPcwbaIX2qRMo+YLXz8QOUdXv5jplHGYSp17Rz/LO6+2b4Yp4XmfVRFL5YyT1scI/H2xpXdk8=@vger.kernel.org X-Gm-Message-State: AOJu0YySF6iGKgorIWTue2oQE8wpHU9UiJ0zwC15fxHX82cFysbjiaXg UWhMrHNqlt/tnd9m+RKGWkgEmzlZFxSRQBvu9KY8qoEBWmr6iIFzwa1fBJBIkK94hE4DOe+0iQS S1wP+3jqFXP1kpT7ya50jNDx2XDKUdyrOHUJL/J6WlHS0j58MxVPkPVWLg16jHa3Q512PkvJHoj 0= X-Gm-Gg: AfdE7cli8U1oRnCVJ4uj0sYooz4hxgEu4OQf1V5f6awfv24dNliYY7EuLkJgmmwJHm+ F/56YhChfNJ5Cn6GUhUiJRBZv72PV61l6ppTePEthay+yfXP//zyPNWWc7ToaIFeGDXOSePFp9m V8BPdsLbbGrWVQoO2e5PBL2Ezm66GF9YxY549YCs3OGv9cegX6zxGDIcZCe0aZavMSIbiZ42BEV sj+SbeIc1cijg8Tq2voYwgMfKBnQA5qTpzkR3A4QXdfyUup7FuUBBZSVwPHKV3m4dsjp2ddgBhI sjWkkhdPFuXHz/VqbjMg0Fxp9xyWCao6nSCWU8IkOhRkrP0b66tSdDbkD9S+7I0xMpyKxoJc5r8 tVBrqe9FPRzJe3O8gskgQLMnyQVnPh4uACWNY6oYRGIfEzUr3c6dBzIpNJi4cFvhR0M2SAr7bN5 PSE+8= X-Received: by 2002:a05:7301:e8e:b0:30b:dd58:e155 with SMTP id 5a478bee46e88-30bf09208c4mr1257506eec.20.1781749595086; Wed, 17 Jun 2026 19:26:35 -0700 (PDT) X-Received: by 2002:a05:7301:e8e:b0:30b:dd58:e155 with SMTP id 5a478bee46e88-30bf09208c4mr1257468eec.20.1781749594545; Wed, 17 Jun 2026 19:26:34 -0700 (PDT) Received: from [192.168.1.31] (c-24-130-122-79.hsd1.ca.comcast.net. [24.130.122.79]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30bcbb684absm4654469eec.1.2026.06.17.19.26.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 17 Jun 2026 19:26:34 -0700 (PDT) Message-ID: Date: Wed, 17 Jun 2026 19:26:32 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 3/3] wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler To: Tristan Madani , Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Tristan Madani References: <20260421135009.348084-1-tristmd@gmail.com> <20260421135009.348084-4-tristmd@gmail.com> From: Jeff Johnson Content-Language: en-US In-Reply-To: <20260421135009.348084-4-tristmd@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-ORIG-GUID: RCoaA5yikUwePTMSzBRRw4md2Ethg7V6 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjE4MDAyMCBTYWx0ZWRfXwmv+iSpVJxMW PGzp+fDv/fBvF/eX4LBi162Bf97WgvfdrIsAPwPzHOofsNmETsmz8BMwhpobhV2xtU9cIEluT6j V2Xty0lSeWs7G00ui41NsnuaxBI710fKCvB2wtU1qS8cRO97SLCcXUzQqf1Au1SanFlTK6Cbo7n tCNJDES1oRFGyBUbuB2doYzgTnvGdrt9A80osISGoJJS8AwwiAIekhK4nd2G4VxVWx2Ag7QhH60 oNauoH6b2e3uJ2arPhOWG+naO9UL8XC3kPD53V/v+TWP64LAq8eDi3b2Aopx3b5gP6gUhpVsXlA 10nBQ2WTzjcX0seYYzOY3f6iO3OcwCBtzaDprYbRYn39MawCtboXuOUpyU+oMIC7hEO7rDVJpQ1 F38C8xR7xOP97ghSFC2CqSpOn7OCYE5kexQx41/TcSMRA3hHSjKRsgSNmui1EDGpTv+bI5ohhW8 Ey9S4m+Lr7ntvY+7Zdg== X-Proofpoint-GUID: RCoaA5yikUwePTMSzBRRw4md2Ethg7V6 X-Proofpoint-Spam-Info: AW1haW4tMjYwNjE4MDAyMCBTYWx0ZWRfXzXd+LzbBKHkq v8hD7LN2aWUlwxEQgTyCFvA7c41TvYEbjwuFOqjLgqpD0XgjwjFEB1h/+yo+nJRYaQSnVcZPux/ eXY0R0dQZhVTcSbFilhMhRcQoTGN5Ak= X-Authority-Analysis: v=2.4 cv=U42iy+ru c=1 sm=1 tr=0 ts=6a33575b cx=c_pps a=cFYjgdjTJScbgFmBucgdfQ==:117 a=Tg7Z00WN3eLgNEO9NLUKUQ==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=J_-Nd1mkAAAA:8 a=I1eazs0kWn-z8uAMkgEA:9 a=QEXdDO2ut3YA:10 a=scEy_gLbYbu1JhEsrz4S:22 a=n8ForQn92ZFaZtFqRdMw:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-17_02,2026-06-17_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 impostorscore=0 spamscore=0 adultscore=0 bulkscore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 malwarescore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606180020 On 4/21/2026 6:50 AM, Tristan Madani wrote: > From: Tristan Madani > > The firmware-controlled num_msg field (u8, 0-255) drives the loop in > ath6kl_wmi_tx_complete_event_rx() without validation against the buffer > length. This allows out-of-bounds reads of up to 1020 bytes past the > WMI event buffer when the firmware sends an inflated num_msg. > > Add a check that the buffer is large enough to hold num_msg entries. > > Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") > Signed-off-by: Tristan Madani > --- > Changes in v3: > - Regenerated from wireless-next with proper git format-patch to > produce valid index hashes (v2 had post-processed index lines). > > Changes in v2: > - No code changes from v1. > > drivers/net/wireless/ath/ath6kl/wmi.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c > index 1cafbac2938fe..f56722c5ef5f1 100644 > --- a/drivers/net/wireless/ath/ath6kl/wmi.c > +++ b/drivers/net/wireless/ath/ath6kl/wmi.c > @@ -484,6 +484,12 @@ static int ath6kl_wmi_tx_complete_event_rx(u8 *datap, int len) > > evt = (struct wmi_tx_complete_event *) datap; > > + if (len < sizeof(*evt) || > + len < sizeof(*evt) + evt->num_msg * sizeof(struct tx_complete_msg_v1)) { > + ath6kl_dbg(ATH6KL_DBG_WMI, "tx complete: invalid len %d for %u msgs\n", > + len, evt->num_msg); In the case where the first test is true, the logging of evt->num_msg will still overread the buffer. I think the logic would be more clear if it follows the pattern in the 2/3 patch, first validate the fixed portion of the struct is available, and then separately validate the variable portion of the struct is available: if (len < sizeof(*evt) { ath6kl_dbg(ATH6KL_DBG_WMI, "tx complete: invalid len %d\n", len); return -EINVAL; } if (len < sizeof(*evt) + evt->num_msg * sizeof(struct tx_complete_msg_v1)) { ath6kl_dbg(ATH6KL_DBG_WMI, "tx complete: invalid len %d for %u msgs\n", len, evt->num_msg); return -EINVAL; } > ath6kl_dbg(ATH6KL_DBG_WMI, "comp: %d %d %d\n", > evt->num_msg, evt->msg_len, evt->msg_type); >