From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f170.google.com (mail-yw1-f170.google.com [209.85.128.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 619F1221FCD for ; Sun, 28 Jun 2026 09:29:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782638942; cv=none; b=GZGIkYRPt5TR0HowJWO0eTeN7szpmqTB7qry8PZOV7ucGOWaS8EtuJv847rKM56zv8YYBmvy3PYHVl6NaGFknvTOWILldsoKrDT36m/KIHrLjLK/7dSmKi3Mp9d0zjlkLh6YOFKR5Ay5UGGh6+zOJ6lOds5G8pq+rq9jsZLBVz4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782638942; c=relaxed/simple; bh=g3TEEhSCxa22KRzyGSBbXztaApgxMd71thbKhrfdhH0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RbSEjFaMLLS216giOhtBA3P9pJT3rJd+z7GpUEp7C7KZLwEG5wiaYyzy2TtJyQ4AUYfv75TEmZ3MIFmCQ4eq1ToRm7gMr+Y0roW39n3C76GQGeDFox4nBEAzJJG6w1GlZUOkaBicjreCn8cbLOCxPHCKldMXsVXutCUVzsVUuzo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IigX29/Y; arc=none smtp.client-ip=209.85.128.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IigX29/Y" Received: by mail-yw1-f170.google.com with SMTP id 00721157ae682-80bab6cf5ebso20951177b3.1 for ; Sun, 28 Jun 2026 02:29:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782638940; x=1783243740; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=XBRPtbJqkKNZ5K9wV4Mq8UH+00E10dqVKsU9yLUE8eI=; b=IigX29/YhnMkZOB9DNFpOEP0mWnZySasxJ1I3piH05xD0NsO5NC/+45L32c8AFjunH jnHWLM196wfYxIsgIFb8UhHd3i8+VQtCPWaC1YKyNzY/hWFv7LovwbeFYaysUeymVgw+ k48geaKAcF36YyRQANprM9Y7VNzehIi44b9eg0S41agWfp//yHUGZoiJGPo50H/OCvdT V9FBLRBE1isbJ4/XaNoL4qdhATBNB2K7bJvdaY9P3ATKj6b7UwVfdECDeB8eGiYVKvNn Vtg3zZzM7FHjEMntBzBVjJ3wrmQJDfwlZ9gLU9ISbpAEIQsjxwqobXvLcjcxYBsWEist ZCXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782638940; x=1783243740; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=XBRPtbJqkKNZ5K9wV4Mq8UH+00E10dqVKsU9yLUE8eI=; b=Mcr/ZtohZACpFZH6+QV4LTKtwcdWFTFkdRT6phUs2j6cVEuqk+fx6I8BOffLV8sa/f EJNb+R9S/YetVzAsLcHZPj1OFJUrqVdkYvKOFf4SHsGNT0Dn8t4hh92Szu2SyLk25CgD AilvgXyeEqfaBL6xPMWcGInkljwkK2lY6RgpGO7e9nrXKLcd3u375EsaFEnliTZ5ZX+N yZXEaBWvqi/96lQJc8zBB0+yn318M52RI/1QYrGaJoslzkhW8p0RKo9rmKoip336F+aj YTZAZPHH93GBQuqRYF62D+FWqZ3ZborP/kS4KEfId6e1I/HnnmHX7v37b9BywWeVfx36 LuZA== X-Forwarded-Encrypted: i=1; AHgh+RoizHbbjQtV9weYstP3ggTc/C4xxT4kJkL5sJsSUa4ADNtpgml/rOK0NyCMxM2S6XIYlWsexBqt/4gYBco=@vger.kernel.org X-Gm-Message-State: AOJu0YzFMC/dN0xBjjGxdEBsL7lkmJ0QmwIxJvXTN2aLJUyfzYHnBTBN zibRzDQsQsw5OqY0Bl1nkQ5PREoJIKGyER+WMtoKg9aHptDhhaI8u0xv X-Gm-Gg: AfdE7ckBTTFHs8dffAvYUh/nqzIGZUCYsW+n2HkwkO6QvaJ4lRO/6AsCTMohLB1gb35 gA5FiBVNCTewIvwH7+XjONZh6105JA3Ebi4J9YS2h9CY3LtwJzcODDxWDjdfsP8qdL5JYibtP21 3/kNOCeZEOzqWydw3tOjjkxdnPR00X4f6PL7EdtbfgvNzP6dowP3GZhS24uhFpGLFa6NeaDNlUn WyNbXQ5jzrXa9bakExFCskXu+AgyP7q3EMlBTI+ZQzwL+lqG+OVrHFPS3bLLPp69ah9fztwmuQz WdJL5keYu+UKRrywtow6eTZ9YX5Th0RjSG093GpJjhlhm1nsMzrl+8i7zAf4hWNFvRVk7SJdKd/ qytLDQqfwzuvxL0kh+dg+/KxUxZtrSXbiE5cyZUJlVUWF6VKdQe9+yiIl3j97aa0LRWoRkvVt36 b0u0W2J40O/I/zEatqCdOIjsynJA== X-Received: by 2002:a05:690e:e89:b0:664:9ffb:e4c with SMTP id 956f58d0204a3-6649ffb1e1amr7317427d50.15.1782638940444; Sun, 28 Jun 2026 02:29:00 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-664b8d0842asm1882897d50.19.2026.06.28.02.28.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 28 Jun 2026 02:28:59 -0700 (PDT) From: Yousef Alhouseen To: Christian Lamparter Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+5c1ca6ccaa1215781cac@syzkaller.appspotmail.com, Yousef Alhouseen Subject: [PATCH] wifi: carl9170: reject mismatched command response lengths Date: Sun, 28 Jun 2026 11:28:14 +0200 Message-ID: <20260628092814.40583-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The firmware response length is controlled by the USB device. Although carl9170_cmd_callback() detects when it differs from the output buffer length, the function falls through and copies the entire response into that buffer. Callers commonly provide stack objects, so a malformed response can overwrite the kernel stack. Return after scheduling device recovery. This also preserves the stated behavior of leaving the command incomplete so that its waiter times out and clears the pending output buffer. Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend") Reported-by: syzbot+5c1ca6ccaa1215781cac@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- drivers/net/wireless/ath/carl9170/rx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c index 6833430130f4..ea3f435fb64c 100644 --- a/drivers/net/wireless/ath/carl9170/rx.c +++ b/drivers/net/wireless/ath/carl9170/rx.c @@ -145,6 +145,7 @@ static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer) * and we get a stack trace from there. */ carl9170_restart(ar, CARL9170_RR_INVALID_RSP); + return; } spin_lock(&ar->cmd_lock); -- 2.54.0