Re: [PATCH] wifi: ath9k: validate RX stream lengths before copying

[Jeff Johnson]

On 9/4/2026 4:59 AM, Toke Høiland-Jørgensen wrote:
> Pengpeng Hou <pengpeng@xxxxxxxxxxx> writes:
> 
>> ath9k_hif_usb_rx_stream() reads RX stream headers and copies payload
>> bytes from the current skb into newly allocated skbs. It also completes
>> packets that span two URBs by copying the remaining bytes from the next
>> skb into hif_dev->remain_skb.
>>
>> The parser checked the stream tag and an upper bound on pkt_len, but it
>> did not first prove that the fixed header, the non-fragmented payload,
>> or the bytes needed to complete a fragmented packet are present in the
>> current skb. Reject malformed RX stream data before reading or copying
>> beyond the received buffer.
>>
>> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> 
> Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>

Can you check the v2: 20260814075716.18804-1-pengpeng@xxxxxxxxxxx