Forwarded: [PATCH] wifi: carl9170: fix stack-out-of-bounds in carl9170_cmd_callback

syzbot
2026-04-24T01:11:04Z

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] wifi: carl9170: fix stack-out-of-bounds in carl9170_cmd_callback
Author: kartikey406@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing

carl9170_cmd_callback() does not return after calling
carl9170_restart() when an invalid command response is detected.
This causes a fall-through into the memcpy block below, where
ar->readbuf is written with a device-controlled length (len - 4)
instead of the expected ar->readlen bytes.

A malicious or fuzzing USB device can send an oversized response
(e.g. 60 bytes) causing a stack-out-of-bounds write into ar->readbuf,
as detected by KASAN.

Fix this by adding a return after carl9170_restart() to match the
original intent stated in the comment ("Do not complete"). Also cap
the memcpy with min_t() as defense-in-depth to prevent overflow even
if the control flow changes in future.

The bug has been present since the initial driver submission in 2010.

Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
Reported-by: syzbot+5c1ca6ccaa1215781cac@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/net/wireless/ath/carl9170/rx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 6833430130f4..6a5923495a01 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -145,12 +145,14 @@ static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
* and we get a stack trace from there.
*/
carl9170_restart(ar, CARL9170_RR_INVALID_RSP);
+ return;
}

spin_lock(&ar->cmd_lock);
if (ar->readbuf) {
if (len >= 4)
- memcpy(ar->readbuf, buffer + 4, len - 4);
+ memcpy(ar->readbuf, buffer + 4,
+ min_t(u32, len - 4, ar->readlen));

ar->readbuf = NULL;
}
--
2.43.0