Re: [PATCH v3 1/3] wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

[Christian Lamparter <chunkeey@gmail.com>]

On 4/21/26 3:49 PM, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> When the firmware sends a command response with a length mismatch,
> carl9170_cmd_callback() logs the mismatch and calls carl9170_restart()
> but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4).
> Since len comes from the firmware and can exceed ar->readlen, this
> copies more data than the readbuf was allocated for.
> 
> Bound the memcpy to min(len - 4, ar->readlen) so that the response
> is still completed -- avoiding repeated restarts from queued garbage --
> while preventing an overread past the response buffer.
> 
> Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>

> ---
> Changes in v3:
>    - Regenerated from wireless-next with proper git format-patch to
>      produce valid index hashes (v2 had post-processed index lines).
> 
> Changes in v2:
>    - No code changes from v1.
> 
>   drivers/net/wireless/ath/carl9170/rx.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
> index 6833430130f4c..f6855efc05c0f 100644
> --- a/drivers/net/wireless/ath/carl9170/rx.c
> +++ b/drivers/net/wireless/ath/carl9170/rx.c
> @@ -150,7 +150,8 @@ static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
>   	spin_lock(&ar->cmd_lock);
>   	if (ar->readbuf) {
>   		if (len >= 4)
> -			memcpy(ar->readbuf, buffer + 4, len - 4);
> +			memcpy(ar->readbuf, buffer + 4,
> +			       min_t(u32, len - 4, ar->readlen));
>   
>   		ar->readbuf = NULL;
>   	}