wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

The firmware-controlled num_msg field (u8, 0-255) drives the loop in
ath6kl_wmi_tx_complete_event_rx() without validation against the buffer
length. This allows out-of-bounds reads of up to 1020 bytes past the
WMI event buffer when the firmware sends an inflated num_msg.

Add a check that the buffer is large enough to hold the fixed struct
and the num_msg variable-length entries.

Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260625232907.3620746-1-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 72611a2ceb9d8e6ac236f3209a4417b0e2ddf567..7e65a03be0b7bb12eae7f79cf38c75fcb1023a08 100644 (file)
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -484,6 +484,18 @@ static int ath6kl_wmi_tx_complete_event_rx(u8 *datap, int len)
 
        evt = (struct wmi_tx_complete_event *) datap;
 
+       if (len < sizeof(*evt)) {
+               ath6kl_dbg(ATH6KL_DBG_WMI, "tx complete: invalid len %d\n",
+                          len);
+               return -EINVAL;
+       }
+
+       if (len < sizeof(*evt) + evt->num_msg * sizeof(struct tx_complete_msg_v1)) {
+               ath6kl_dbg(ATH6KL_DBG_WMI, "tx complete: invalid len %d for %u msgs\n",
+                          len, evt->num_msg);
+               return -EINVAL;
+       }
+
        ath6kl_dbg(ATH6KL_DBG_WMI, "comp: %d %d %d\n",
                   evt->num_msg, evt->msg_len, evt->msg_type);