[PATCH] wifi: wil6210: wmi: prevent underflow in wmi_evt_auth_status()

Dan Carpenter
2026-04-20T15:19:12Z

The problem is this condition:

if (ie_len < auth_ie_offset) {

The test is supposed to ensure that "d" is large enough to hold a struct
wmi_ft_auth_status_event and 3 additional u16 values. The "ie_len"
variable can be negative but, because "auth_ie_offset" is type size_t,
then negatives are type promoted to high positive values and treated as
success. The effect of this bug is that when we do:

d_len = le16_to_cpu(data->ie_len);

then we may be beyond the end of the "d" / "data" buffer. Fortunately,
on the next line:

if (d_len != ie_len) {

the contition will be false so the negative effects of this bug are
quite limited.

Fix this bug by changing the type of "auth_ie_offset" to int.

Fixes: b9010f105f21 ("wil6210: add FT roam support for AP and station")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/net/wireless/ath/wil6210/wmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 479b2418ca34..57e6a43a04cf 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -1629,7 +1629,7 @@ wmi_evt_auth_status(struct wil6210_vif *vif, int id, void *d, int len)
struct cfg80211_ft_event_params ft;
u16 d_len;
/* auth_alg(u16) + auth_transaction(u16) + status_code(u16) */
- const size_t auth_ie_offset = sizeof(u16) * 3;
+ const int auth_ie_offset = sizeof(u16) * 3;
struct auth_no_hdr *auth = (struct auth_no_hdr *)data->ie_info;

/* check the status */
--
2.53.0