Re: [PATCH] wifi: ath9k: validate WMI response length before copying

[Jeff Johnson <jeff.johnson@oss.qualcomm.com>]

On 9/4/2026 3:21 AM, Toke Høiland-Jørgensen wrote:
> Pengpeng Hou <pengpeng@iscas.ac.cn> writes:
> 
>> ath9k_wmi_rsp_callback() removes the WMI command header from the skb
>> and then copies wmi->cmd_rsp_len bytes into the waiting response
>> buffer.  The response length is expected by the waiting command path,
>> while the skb length comes from the device response.  A short response
>> can therefore be read past the end of the skb data.
>>
>> Record malformed short responses in the WMI state and return the error
>> to the waiting command path after completion.  This avoids both the
>> out-of-bounds read and the false-success case where callers would
>> consume stale response data.
>>
>> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> 
> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>

Can you check the v2: 20260814075837.20005-1-pengpeng@iscas.ac.cn

/jeff