Re: [PATCH v4] wifi: ath6kl: fix OOB access from firmware ADDBA window size

[Jeff Johnson]

On 6/28/2026 9:57 PM, Vasanthakumar Thiagarajan wrote:
> 
> 
> On 6/26/2026 5:34 AM, Tristan Madani wrote:
>> aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied
>> win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not
>> return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to
>> compute a kzalloc size and stored in rxtid->hold_q_sz, leading to
>> zero-size or overflowed allocations and subsequent out-of-bounds access.
>>
>> Clean up any previously active aggregation session for the TID first,
>> then return early when win_sz is out of the valid range, instead of
>> proceeding with a broken allocation size.
>>
>> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@xxxxxxxxxxxxxxxx>
> 
> You can remove my suggested-by as I only provided review comments on your patch.
> 
>> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> 
> With the above comment addressed,
> 
> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@xxxxxxxxxxxxxxxx>

Can you repost a v5. I can't take this one since:

WARNING:FROM_SIGN_OFF_MISMATCH: From:/Signed-off-by: email address mismatch:
'From: Tristan Madani <tristmd@xxxxxxxxx>' != 'Signed-off-by: Tristan Madani
<tristan@xxxxxxxxxxxxxxxxxxx>'

You missed adding the From: tag in v4