ath6kl_wmi_connect_event_rx() only checks that the received event is at least sizeof(struct wmi_connect_event); it never checks that the trailing beacon_ie_len + assoc_req_len + assoc_resp_len fields fit within the received buffer. Those attacker/AP-influenced lengths then drive two out-of-bounds accesses: - The WMM information-element scan builds peie = assoc_info + beacon_ie_len + assoc_req_len + assoc_resp_len and walks up to it, reading past the end of the event buffer when the declared lengths exceed the buffer. The walk also dereferences pie[1..6] and pie[1] (for the advance) without checking they stay within peie. - ath6kl_cfg80211_connect_event() subtracts fixed offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. A short assoc request/response underflows the length to ~250, which cfg80211_connect_result() / cfg80211_roamed() then treat as the IE length and copy out of bounds from the small assoc_info buffer, disclosing adjacent slab memory to user space via nl80211. Bound the declared IE lengths against the received buffer, bound the WMM element reads against peie, and clamp the assoc request/response lengths before the subtraction. The sibling wil6210 driver already performs the equivalent length check for the same WMI connect event. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bounds are evident from source and cross-checked against the sibling wil6210 driver. Compile-tested. Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") Cc: stable@vger.kernel.org Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk --- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 +++++ drivers/net/wireless/ath/ath6kl/wmi.c | 10 +++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c index cc0f2c45fc3a..62f663c0daa2 100644 --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c @@ -754,6 +754,11 @@ void ath6kl_cfg80211_connect_event(struct ath6kl_vif *vif, u16 channel, u8 *assoc_resp_ie = assoc_info + beacon_ie_len + assoc_req_len + assoc_resp_ie_offset; + if (assoc_req_len < assoc_req_ie_offset) + assoc_req_len = assoc_req_ie_offset; + if (assoc_resp_len < assoc_resp_ie_offset) + assoc_resp_len = assoc_resp_ie_offset; + assoc_req_len -= assoc_req_ie_offset; assoc_resp_len -= assoc_resp_ie_offset; diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c index 72611a2ceb9d..fbfd74154d12 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c @@ -862,6 +862,10 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len, ev = (struct wmi_connect_event *) datap; + if (len < sizeof(*ev) + ev->beacon_ie_len + ev->assoc_req_len + + ev->assoc_resp_len) + return -EINVAL; + if (vif->nw_type == AP_NETWORK) { /* AP mode start/STA connected event */ struct net_device *dev = vif->ndev; @@ -913,7 +917,8 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len, while (pie < peie) { switch (*pie) { case WLAN_EID_VENDOR_SPECIFIC: - if (pie[1] > 3 && pie[2] == 0x00 && pie[3] == 0x50 && + if (pie + 7 <= peie && pie[1] > 3 && + pie[2] == 0x00 && pie[3] == 0x50 && pie[4] == 0xf2 && pie[5] == WMM_OUI_TYPE) { /* WMM OUT (00:50:F2) */ if (pie[1] > 5 && @@ -926,6 +931,9 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len, if (wmi->is_wmm_enabled) break; + if (pie + 1 >= peie) + break; + pie += pie[1] + 2; } -- 2.43.0