Re: [PATCH] wifi: ath11k: Reject short management RX frames

[Jeff Johnson]

On Sat, 26 Sep 2026 19:40:37 +0800, Jiale Yao wrote:
> ath11k_pull_mgmt_rx_params_tlv() verifies that the firmware-reported frame
> length fits in the WMI event, but does not ensure that it can hold an IEEE
> 802.11 management header. It then sets skb->len to that reported length.
> 
> ath11k_mgmt_rx_event() subsequently reads frame_control and other header
> fields without another length check. A firmware event with a short buf_len
> can therefore cause an out-of-bounds read.
> 
> [...]

Applied, thanks!

[1/1] wifi: ath11k: Reject short management RX frames
      commit: 9e15ccad0877c4a748bf2b817811a23f2d71bd92

Best regards,
-- 
Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>