Forwarded: Re: KASAN: stack-out-of-bounds Write in carl9170_handle_command_response

[syzbot <syzbot+5c1ca6ccaa1215781cac@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: KASAN: stack-out-of-bounds Write in carl9170_handle_command_response
Author: doruk@0sec.ai

#syz test

diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 908c4c8..897e682 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -150,7 +150,8 @@ static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
 	spin_lock(&ar->cmd_lock);
 	if (ar->readbuf) {
 		if (len >= 4)
-			memcpy(ar->readbuf, buffer + 4, len - 4);
+			memcpy(ar->readbuf, buffer + 4,
+			       min_t(unsigned int, len - 4, ar->readlen));
 
 		ar->readbuf = NULL;
 	}
-- 
2.43.0