Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Kalle Valo <kvalo@kernel.org>
To:     Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
Cc:     Minsuk Kang <linuxlovemin@yonsei.ac.kr>,
        linux-wireless@vger.kernel.org, dokyungs@yonsei.ac.kr,
        jisoo.jang@yonsei.ac.kr
Subject: Re: [PATCH v2] ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
References: <20230104124130.10996-1-linuxlovemin@yonsei.ac.kr>
        <87zgay1ho0.fsf@toke.dk>
Date:   Tue, 10 Jan 2023 14:25:06 +0200
In-Reply-To: <87zgay1ho0.fsf@toke.dk> ("Toke \=\?utf-8\?Q\?H\=C3\=B8iland-J\?\=
 \=\?utf-8\?Q\?\=C3\=B8rgensen\=22's\?\= message of
        "Wed, 04 Jan 2023 15:46:39 +0100")
Message-ID: <87ilhefufx.fsf@kernel.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Toke H=C3=B8iland-J=C3=B8rgensen <toke@toke.dk> writes:

> Minsuk Kang <linuxlovemin@yonsei.ac.kr> writes:
>
>> Fix a stack-out-of-bounds write that occurs in a WMI response callback
>> function that is called after a timeout occurs in ath9k_wmi_cmd().
>> The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that
>> could no longer be valid when a timeout occurs. Set wmi->last_seq_id to
>> 0 when a timeout occurred.
>>
>> Found by a modified version of syzkaller.
>>
>> BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx
>> Write of size 4
>> Call Trace:
>>  memcpy
>>  ath9k_wmi_ctrl_rx
>>  ath9k_htc_rx_msg
>>  ath9k_hif_usb_reg_in_cb
>>  __usb_hcd_giveback_urb
>>  usb_hcd_giveback_urb
>>  dummy_timer
>>  call_timer_fn
>>  run_timer_softirq
>>  __do_softirq
>>  irq_exit_rcu
>>  sysvec_apic_timer_interrupt
>>
>> Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
>
> Acked-by: Toke H=C3=B8iland-J=C3=B8rgensen <toke@toke.dk>
>
> Also (Kalle, I assume you can just add this):
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")

Yes, will add.

--=20
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatc=
hes