Re: [PATCH 2/2] wifi: ath9k: drop WMI command responses when no command is pending

[Toke Høiland-Jørgensen]

Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx> writes:

> ath9k_wmi_ctrl_rx() accepts a command response whose sequence number
> matches wmi->last_seq_id and copies it to wmi->cmd_rsp_buf, which
> usually points into the stack frame of the ath9k_wmi_cmd() caller.
> Only the timeout path clears last_seq_id, since
> commit 8a2f35b98306 ("wifi: ath9k: Fix potential stack-out-of-bounds
> write in ath9k_wmi_rsp_callback()"). After a normal completion or a
> failed send the receive path stays armed, so a duplicate response from
> a buggy or malicious device is written into a stack frame that is gone,
> and its extra complete() makes the next command return before its own
> response arrives. Sequence number 0, which means "nothing pending", is
> also used for a command once tx_seq_id wraps.
>
> Keep the receive path armed only while a command is pending: disarm it
> once a response has been handled, on timeout and when sending fails,
> drop responses while nothing is pending, never use sequence number 0,
> and reinitialise the completion before each command is issued.
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx>

Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>