Re: [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers

[Jeff Johnson]

On 7/12/2026 7:06 PM, Baochen Qiang wrote:
> 
> 
> On 7/12/2026 2:04 AM, Jeff Johnson wrote:
>> The following WMI event handlers currently read from the event buffer
>> without first verifying that the message was large enough to hold the
>> expected event:
>> ath6kl_wmi_scan_complete_rx()
>> ath6kl_wmi_addba_req_event_rx()
>> ath6kl_wmi_delba_req_event_rx()
>>
>> Add length checks to prevent overread.
>>
>> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
>> Assisted-by: Claude:claude-sonnet-4-6
>> Signed-off-by: Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>
>> ---
>> Changes in v2:
>> - Added fixes for two more functions: ath6kl_wmi_addba_req_event_rx and ath6kl_wmi_delba_req_event_rx
>> - v1 subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx()
>> - Link to v1: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx-v1-1-7b11e5f8b96c@xxxxxxxxxxxxxxxx
>> ---
>>  drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++--
>>  1 file changed, 15 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
>> index 72611a2ceb9d..08030d88c7d3 100644
>> --- a/drivers/net/wireless/ath/ath6kl/wmi.c
>> +++ b/drivers/net/wireless/ath/ath6kl/wmi.c
>> @@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
>>  {
>>  	struct wmi_scan_complete_event *ev;
>>  
>> +	if (len < sizeof(*ev))
>> +		return -EINVAL;
>> +
>>  	ev = (struct wmi_scan_complete_event *) datap;
>>  
>>  	ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));
>> @@ -3352,7 +3355,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
>>  static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
>>  					 struct ath6kl_vif *vif)
>>  {
>> -	struct wmi_addba_req_event *cmd = (struct wmi_addba_req_event *) datap;
>> +	struct wmi_addba_req_event *cmd;
>> +
>> +	if (len < sizeof(*cmd))
>> +		return -EINVAL;
>> +
>> +	cmd = (struct wmi_addba_req_event *) datap;
> 
> Nit: No space is necessary after a cast. This is a preexisting issue, since you are
> touching, better to fix it together.

Yeah, let me make those changes in 'pending'
/jeff