Re: [PATCH v3 3/3] wifi: carl9170: fix buffer overflow in rx_stream failover path

[Jeff Johnson]

On 4/21/2026 6:49 AM, Tristan Madani wrote:
> From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> 
> The failover continuation in carl9170_rx_stream() copies the full tlen
> from the second USB transfer instead of capping at rx_failover_missing
> bytes. When both transfers are near maximum size, the total exceeds the
> 65535-byte failover SKB, triggering skb_over_panic.
> 
> Limit the copy size to the missing byte count.
> 
> Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
> Changes in v3:
>   - Regenerated from wireless-next with proper git format-patch.
> 
> Changes in v2:
>   - Use min_t() instead of separate if-check, per Christian Lamparter.
> 
>  drivers/net/wireless/ath/carl9170/rx.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
> index f6855efc05c0f..ccadc46385240 100644
> --- a/drivers/net/wireless/ath/carl9170/rx.c
> +++ b/drivers/net/wireless/ath/carl9170/rx.c
> @@ -918,7 +918,9 @@ static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len)
>  				}
>  			}
>  
> -			skb_put_data(ar->rx_failover, tbuf, tlen);
> +			skb_put_data(ar->rx_failover, tbuf,
> +			     min_t(unsigned int, tlen,

checkpatch complains:
CHECK:PARENTHESIS_ALIGNMENT: Alignment should match open parenthesis

no need to repost for this, I can fix when applying

> +				   ar->rx_failover_missing));
>  			ar->rx_failover_missing -= tlen;
>  
>  			if (ar->rx_failover_missing <= 0) {