Re: [PATCH] wifi: ath9k: validate RX stream lengths before copying

[Toke Høiland-Jørgensen]

Pengpeng Hou <pengpeng@xxxxxxxxxxx> writes:

> ath9k_hif_usb_rx_stream() reads RX stream headers and copies payload
> bytes from the current skb into newly allocated skbs. It also completes
> packets that span two URBs by copying the remaining bytes from the next
> skb into hif_dev->remain_skb.
>
> The parser checked the stream tag and an upper bound on pkt_len, but it
> did not first prove that the fixed header, the non-fragmented payload,
> or the bytes needed to complete a fragmented packet are present in the
> current skb. Reject malformed RX stream data before reading or copying
> beyond the received buffer.
>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>

Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>