Re: [PATCH 1/2] wifi: ath9k: don't read past short WMI command responses

[Toke Høiland-Jørgensen]

Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx> writes:

> ath9k_wmi_rsp_callback() copies cmd_rsp_len bytes from the response
> without checking how many bytes the device sent. A short or empty
> response makes it copy stale bytes from the uninitialised USB REG_IN
> buffer into the caller's buffer, e.g. into the value returned by
> ath9k_regread().
>
> Commit 93ce8ea70451 ("wifi: ath9k: reject short WMI command responses")
> failed such responses with -EMSGSIZE, but AR9271 firmware answers
> commands that return nothing with an empty response, so that broke
> normal operation and was reverted by commit 90201351a862 ("wifi: atk9k:
> Revert "wifi: ath9k: reject short WMI command responses"").
>
> Copy only the bytes that were received and zero the rest of the
> caller's buffer instead. Empty responses keep completing successfully,
> and callers no longer see bytes the device never sent.
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx>

Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>