wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len
fields in ath6kl_wmi_connect_event_rx() are not validated against the
buffer length. Their sum (up to 765) can exceed the actual WMI event
data, causing out-of-bounds reads during IE parsing and state corruption
of wmi->is_wmm_enabled.

Add a check that the total IE length fits within the buffer.

Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135009.348084-3-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 7e65a03be0b7bb12eae7f79cf38c75fcb1023a08..2b0c5038ae040344f729b3f2a635e26cf961caa7 100644 (file)
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -874,6 +874,14 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len,
 
        ev = (struct wmi_connect_event *) datap;
 
+       if (len < sizeof(*ev) + ev->beacon_ie_len +
+           ev->assoc_req_len + ev->assoc_resp_len) {
+               ath6kl_dbg(ATH6KL_DBG_WMI,
+                          "connect event: IE lengths %u+%u+%u exceed buffer %d\n",
+                          ev->beacon_ie_len, ev->assoc_req_len,
+                          ev->assoc_resp_len, len);
+               return -EINVAL;
+       }
        if (vif->nw_type == AP_NETWORK) {
                /* AP mode start/STA connected event */
                struct net_device *dev = vif->ndev;