Re: [PATCH] wifi: ath9k: validate RX stream lengths before copying

[Toke Høiland-Jørgensen]

Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx> writes:

> On 9/4/2026 4:59 AM, Toke Høiland-Jørgensen wrote:
>> Pengpeng Hou <pengpeng@xxxxxxxxxxx> writes:
>> 
>>> ath9k_hif_usb_rx_stream() reads RX stream headers and copies payload
>>> bytes from the current skb into newly allocated skbs. It also completes
>>> packets that span two URBs by copying the remaining bytes from the next
>>> skb into hif_dev->remain_skb.
>>>
>>> The parser checked the stream tag and an upper bound on pkt_len, but it
>>> did not first prove that the fixed header, the non-fragmented payload,
>>> or the bytes needed to complete a fragmented packet are present in the
>>> current skb. Reject malformed RX stream data before reading or copying
>>> beyond the received buffer.
>>>
>>> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
>> 
>> Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>
>
> Can you check the v2: 20260814075716.18804-1-pengpeng@xxxxxxxxxxx

Meh, the extra zeroing in v2 doesn't seem to serve any purpose, so let's
just go with this one...

-Toke