[PATCH ath-next] wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

[Jeff Johnson]

On Thu, 16 Jul 2026 13:01:31 -0700, Jeff Johnson wrote:
> Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read
> without first verifying that the buffer has enough data to hold a
> header. This could result in a buffer overread.
> 
> Add an upfront length check before dereferencing skb->data as a
> wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event()
> call to preserve the existing trace semantics (tracing the full raw
> WMI event including the header), unlike the analogous ath12k fix which
> could use skb_pull_data() directly.
> 
> [...]

Applied, thanks!

[1/1] wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
      commit: 2ab768b2a3c0a31a6270d3c7fdd25912fc341533

Best regards,
-- 
Jeff Johnson <jeff.johnson at oss.qualcomm.com>