Re: [PATCH] wifi: ath6kl: validate assoc info lengths in the WMI connect event

[Jeff Johnson]

On 7/11/2026 12:13 AM, Doruk Tan Ozturk wrote:
> ath6kl_wmi_connect_event_rx() only checks that the received event is at
> least sizeof(struct wmi_connect_event); it never checks that the trailing
> beacon_ie_len + assoc_req_len + assoc_resp_len fields fit within the
> received buffer. Those attacker/AP-influenced lengths then drive two
> out-of-bounds accesses:
> 
>   - The WMM information-element scan builds
>     peie = assoc_info + beacon_ie_len + assoc_req_len + assoc_resp_len
>     and walks up to it, reading past the end of the event buffer when the
>     declared lengths exceed the buffer. The walk also dereferences
>     pie[1..6] and pie[1] (for the advance) without checking they stay
>     within peie.
> 
>   - ath6kl_cfg80211_connect_event() subtracts fixed offsets from
>     assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower
>     bound. A short assoc request/response underflows the length to ~250,
>     which cfg80211_connect_result() / cfg80211_roamed() then treat as the
>     IE length and copy out of bounds from the small assoc_info buffer,
>     disclosing adjacent slab memory to user space via nl80211.
> 
> Bound the declared IE lengths against the received buffer, bound the WMM
> element reads against peie, and clamp the assoc request/response lengths
> before the subtraction. The sibling wil6210 driver already performs the
> equivalent length check for the same WMI connect event.
> 
> Found by 0sec (https://0sec.ai) using automated source analysis; the
> missing bounds are evident from source and cross-checked against the
> sibling wil6210 driver. Compile-tested.
> 
> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: 0sec:claude-opus-4-8
> Signed-off-by: Doruk Tan Ozturk <doruk@xxxxxxx>

Some aspects of your patch are already addressed by:
https://lore.kernel.org/all/20260421135009.348084-3-tristmd@xxxxxxxxx

So you will need to rebase once that lands.

/jeff