Re: [PATCH] wifi: ath10k: validate WMI header before reading it

[Jeff Johnson]

On 7/21/2026 9:20 PM, Pengpeng Hou wrote:

> diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
> index e57588c19c80..5b64b5f9bff7 100644
> --- a/drivers/net/wireless/ath/ath10k/wmi.c
> +++ b/drivers/net/wireless/ath/ath10k/wmi.c
> @@ -5873,16 +5873,28 @@ static inline void ath10k_wmi_queue_set_coverage_class_work(struct ath10k *ar)
>  	}
>  }
>  
> +bool ath10k_wmi_pull_cmd_hdr(struct sk_buff *skb, u32 *cmd_id)
> +{
> +	const struct wmi_cmd_hdr *cmd_hdr;
> +
> +	if (!pskb_may_pull(skb, sizeof(*cmd_hdr)))
> +		return false;
> +
> +	cmd_hdr = (const void *)skb->data;
> +	*cmd_id = __le32_to_cpu(cmd_hdr->cmd_id);
> +	skb_pull(skb, sizeof(*cmd_hdr));

consider following the pattern from my ath12k patch instead:
https://patch.msgid.link/20260716-ath12k_wmi_op_rx-overread-v1-1-327a4b1c2372@xxxxxxxxxxxxxxxx

use skb_pull_data() instead of pskb_may_pull() + skb_pull()
consider masking out the id here instead of in each of the callers
(if all of the caller have the same masking)

> +
> +	return true;
> +}