From: "Toke Høiland-Jørgensen" <toke@toke.dk>
To: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Cc: Jeff Johnson <jeff.johnson@oss.qualcomm.com>,
Pengpeng Hou <pengpeng@iscas.ac.cn>,
Mehmet Fide <mehmet.fide@gmail.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
Michail Andreas Michalopoulos <mike.michalo@gmail.com>,
stable@vger.kernel.org
Subject: Re: [PATCH 1/2] wifi: ath9k: don't read past short WMI command responses
Date: Fri, 23 Oct 2026 13:05:29 +0200 [thread overview]
Message-ID: <878q3osmme.fsf@toke.dk> (raw)
In-Reply-To: <20261020152412.95560-2-mike.michalo@gmail.com>
Michail Andreas Michalopoulos <mike.michalo@gmail.com> writes:
> ath9k_wmi_rsp_callback() copies cmd_rsp_len bytes from the response
> without checking how many bytes the device sent. A short or empty
> response makes it copy stale bytes from the uninitialised USB REG_IN
> buffer into the caller's buffer, e.g. into the value returned by
> ath9k_regread().
>
> Commit 93ce8ea70451 ("wifi: ath9k: reject short WMI command responses")
> failed such responses with -EMSGSIZE, but AR9271 firmware answers
> commands that return nothing with an empty response, so that broke
> normal operation and was reverted by commit 90201351a862 ("wifi: atk9k:
> Revert "wifi: ath9k: reject short WMI command responses"").
>
> Copy only the bytes that were received and zero the rest of the
> caller's buffer instead. Empty responses keep completing successfully,
> and callers no longer see bytes the device never sent.
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
next prev parent reply other threads:[~2026-10-23 11:05 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 15:24 [PATCH 0/2] wifi: ath9k: fix WMI command response handling Michail Andreas Michalopoulos
2026-10-20 15:24 ` [PATCH 1/2] wifi: ath9k: don't read past short WMI command responses Michail Andreas Michalopoulos
2026-10-23 11:05 ` Toke Høiland-Jørgensen [this message]
2026-10-20 15:24 ` [PATCH 2/2] wifi: ath9k: drop WMI command responses when no command is pending Michail Andreas Michalopoulos
2026-10-23 11:05 ` Toke Høiland-Jørgensen
2026-10-20 22:46 ` [PATCH 0/2] wifi: ath9k: fix WMI command response handling Mehmet Fide
2026-10-20 23:19 ` mixalhs
2026-10-28 23:03 ` Jeff Johnson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878q3osmme.fsf@toke.dk \
--to=toke@toke.dk \
--cc=jeff.johnson@oss.qualcomm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=mehmet.fide@gmail.com \
--cc=mike.michalo@gmail.com \
--cc=pengpeng@iscas.ac.cn \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.