Re: [PATCH] wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

[Jeff Johnson]

On Mon, 13 Jul 2026 23:32:51 +0200, Doruk Tan Ozturk wrote:
> ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from
> assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower
> bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()
> bounds the declared lengths from above (their sum must fit the received
> event), but an assoc request/response shorter than its fixed offset still
> underflows here: the u8 wraps to ~250, and cfg80211_connect_result() /
> cfg80211_roamed() then treat that wrapped value as the IE length and copy
> that many bytes out of the small assoc_info buffer to user space via
> nl80211, disclosing adjacent slab memory.
> 
> [...]

Applied, thanks!

[1/1] wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
      commit: 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613

Best regards,
-- 
Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>