Re: [PATCH] wifi: ath9k: validate WMI response length before copying

[Toke Høiland-Jørgensen]

Pengpeng Hou <pengpeng@xxxxxxxxxxx> writes:

> ath9k_wmi_rsp_callback() removes the WMI command header from the skb
> and then copies wmi->cmd_rsp_len bytes into the waiting response
> buffer.  The response length is expected by the waiting command path,
> while the skb length comes from the device response.  A short response
> can therefore be read past the end of the skb data.
>
> Record malformed short responses in the WMI state and return the error
> to the waiting command path after completion.  This avoids both the
> out-of-bounds read and the false-success case where callers would
> consume stale response data.
>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>

Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>