Re: [PATCH] wifi: ath9k: validate WMI response length before copying

[Toke Høiland-Jørgensen]

Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx> writes:

> On 9/4/2026 3:21 AM, Toke Høiland-Jørgensen wrote:
>> Pengpeng Hou <pengpeng@xxxxxxxxxxx> writes:
>> 
>>> ath9k_wmi_rsp_callback() removes the WMI command header from the skb
>>> and then copies wmi->cmd_rsp_len bytes into the waiting response
>>> buffer.  The response length is expected by the waiting command path,
>>> while the skb length comes from the device response.  A short response
>>> can therefore be read past the end of the skb data.
>>>
>>> Record malformed short responses in the WMI state and return the error
>>> to the waiting command path after completion.  This avoids both the
>>> out-of-bounds read and the false-success case where callers would
>>> consume stale response data.
>>>
>>> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
>> 
>> Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>
>
> Can you check the v2: 20260814075837.20005-1-pengpeng@xxxxxxxxxxx

The code seems to be identical, only the commit message differs, so up
to you which version you want to take :)

-Toke