[PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx()

[Jeff Johnson]

Currently, ath6kl_wmi_scan_complete_rx() dereferences ev->status
without first verifying that the event buffer is large enough to hold
a wmi_scan_complete_event. Add a length check to prevent overread.

Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Signed-off-by: Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>
---
 drivers/net/wireless/ath/ath6kl/wmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 72611a2ceb9d..1645f59b0dc1 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
 {
 	struct wmi_scan_complete_event *ev;
 
+	if (len < sizeof(*ev))
+		return -EINVAL;
+
 	ev = (struct wmi_scan_complete_event *) datap;
 
 	ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));

---
base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd
change-id: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7