Re: [PATCH v3 2/3] wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

[Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>]

On 4/21/2026 7:20 PM, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len
> fields in ath6kl_wmi_connect_event_rx() are not validated against the
> buffer length. Their sum (up to 765) can exceed the actual WMI event
> data, causing out-of-bounds reads during IE parsing and state corruption
> of wmi->is_wmm_enabled.
> 
> Add a check that the total IE length fits within the buffer.
> 
> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
> Changes in v3:
>    - Regenerated from wireless-next with proper git format-patch to
>      produce valid index hashes (v2 had post-processed index lines).
> 
> Changes in v2:
>    - No code changes from v1.
> 
>   drivers/net/wireless/ath/ath6kl/wmi.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
> index 72611a2ceb9d8..1cafbac2938fe 100644
> --- a/drivers/net/wireless/ath/ath6kl/wmi.c
> +++ b/drivers/net/wireless/ath/ath6kl/wmi.c
> @@ -862,6 +862,14 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len,
>   
>   	ev = (struct wmi_connect_event *) datap;
>   
> +	if (len < sizeof(*ev) + ev->beacon_ie_len +
> +	    ev->assoc_req_len + ev->assoc_resp_len) {
> +		ath6kl_dbg(ATH6KL_DBG_WMI,
> +			   "connect event: IE lengths %u+%u+%u exceed buffer %d\n",
> +			   ev->beacon_ie_len, ev->assoc_req_len,
> +			   ev->assoc_resp_len, len);
> +		return -EINVAL;
> +	}
>   	if (vif->nw_type == AP_NETWORK) {
>   		/* AP mode start/STA connected event */
>   		struct net_device *dev = vif->ndev;


Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>