From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A58F92C0303 for ; Sat, 4 Jul 2026 19:48:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783194514; cv=none; b=GwCp/IN1jWUDmNUrbDlodi5LtVMR9+AmxhYrP7kvnUirfAud79I906C3f53Mj6dmke9FTK3IDqkJ3FcpD8tCJyYtgcYKiauawedtsDTYOb/BUbjmGgJRgEWXaGOVsk5NOGx6chO+ardsLzU5aktAB0sNNpc4tsqe7wX7QU52tTI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783194514; c=relaxed/simple; bh=+TO/qNl/0FdIFuKVmQ+xVp/v9nqEpZkPw4eUZgFqTbc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=aWbl0nFKfec5FHB3WZA2ArXn/F1WDrpAJQ5NYr03vTiZ+UR0AXgjbZajlRxxSzaFZ3JraY3faEurv8yu7FX/YHyht/dYWyeHfqmLLIQXS5n1xA6Q6DkcBZgFy+MKJOVlC5K7sUy0RaFQRkGJXlb+d2xK26vq4M7U7QOrd/G8nLM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=elEA/Ldl; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="elEA/Ldl" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-493c19bad03so14658795e9.2 for ; Sat, 04 Jul 2026 12:48:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783194511; x=1783799311; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=lEyqJwfyH2jgv+Eu0NdsBWQhxvi9pBURuWdxLLJyU20=; b=elEA/Ldlqs3ZSefXbR+6alF5CrW4gbGw4WXoVOe/ejRJwAI+MGxpgRkEq2F406VQK/ ssrKgOwVKx/4Vb8ArzibwspQS0KjHL/j8rkShaWu5N5aonpuMd8F+WVsvmniV9GXmqHd Zi1Cj2/aESkp49KDXiZ/oLl8OI62RVYJnr+9lL9H7AiCIZnihPBG0Nt3UrOkGw6YQlpb Wg5OrM+kv0+emd5wmiAjo7Vq0R4C7OAGzbkkV+JBAWkt4g8fuSt11h3ughJmY30sRgvg g3ORp3QffDgWM+f7wfbEq/PysPph8TVLKWSC2w/SMAJ0Eo6Jvyz6dVNrW7Bhwtu4h2I1 Mpgg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783194511; x=1783799311; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=lEyqJwfyH2jgv+Eu0NdsBWQhxvi9pBURuWdxLLJyU20=; b=fhl34nhhnIXFARTND6+mSRDN+yDUeq88RBJYnoE6L5fuKyHuHb0orvQfkrnXzBu3AE wWDjCZ64NpUyZiXtO108ugSe6EeXuG6lUvJRgzPyT6PUysbjVBUfeJVted0yMpKpa6ow Drs/Z9f/wev9xJmPt3bmnCCfQdVTmUmg5ZaNh6f2BY9zyQxC1f1elCNdJdodygcR6/ca EDnll5chaejS6z7tm7cYJ3L0QRrTfoKkrtVndTpHrXubAun7Sn8W3wD88XQF9xuaG44S U7sWs4w7+MZ8GfphcL6LSyU8ewR3XNVMjxGKsUrByeHuHHZJoaRkIIp8EPBCfRHf0ddb AlcA== X-Forwarded-Encrypted: i=1; AFNElJ/spUtyNgCHxxAoTX8neEWtW4rnXzWcF8BTiZxyoo8ympVfgQAJsHrx/JGzfdVDykWTtY3Zz/TguNX6E1E=@vger.kernel.org X-Gm-Message-State: AOJu0YxN1F9Q686gAjyKfUcxlPOV8djHjarShx3/Fm3Xj3OVokqsetjB YHYV2kAZDcgwq5ijM+UtlyhN5CXwb5FM9cdSAKvTvD39CB8aCzXGAt4t X-Gm-Gg: AfdE7cko1Vumk9KOtIB1dRdzbiOVK+Kp99evcqfUR9iB61Fu6CAWDR8PfYfRfhFOSPs SpZ5jp58BfStfpiBSdChXbg/sRVmceOqG9kHHDfNaA+w6+/8i4N75fKtV/pp9NIx441QfFypjrn FIABVgmJA6fK1EPrEegNAr2nCCf11kZQ85bkIDjhZAIDQwUZYz4IgrRbNxLevJh4Of4XqOENt8Z 7lm0k6kVtfIjlr7107bsl5Lo0KFTv1eDULOM56j4vimNll5CcYKPbLuJuuVDsxrphe2+zLedBkV 05i8lOUKAZWlgZFTKQwK5I1jphHIHZkN7HHby9g+5HbS7J7NJgCyTTxiYW6wj+4x5Zfo37e2sja 5aN11SuI66uC3ARYoniPB19t8DMzzQoSJDkKBvgZaXMdCWJGnoC458WGMbLFvLyuxM6F2OKgWg6 283iHyZ1b0FFMy4SEADwid3xfg+gSjBvMDHAMrXNaztO9RFzr8pI8mRjxkti6U9phvnHN87mRI9 O/TBjKsv/4= X-Received: by 2002:a05:600c:8711:b0:493:aa24:792b with SMTP id 5b1f17b1804b1-493d11f15c6mr45985435e9.22.1783194510915; Sat, 04 Jul 2026 12:48:30 -0700 (PDT) Received: from shift (p200300d5ff229f0050f496fffe46beef.dip0.t-ipconnect.de. [2003:d5:ff22:9f00:50f4:96ff:fe46:beef]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493c63bfba1sm264034355e9.15.2026.07.04.12.48.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Jul 2026 12:48:30 -0700 (PDT) Received: from localhost ([127.0.0.1]) by shift with esmtp (Exim 4.99.4) (envelope-from ) id 1wg6Ll-00000000JoV-1nGR; Sat, 04 Jul 2026 21:48:29 +0200 Message-ID: Date: Sat, 4 Jul 2026 21:48:29 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 2/3] wifi: carl9170: fix OOB read from off-by-two in TX status handler To: Tristan Madani , Christian Lamparter Cc: Johannes Berg , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Tristan Madani References: <20260421134929.325662-1-tristmd@gmail.com> <20260421134929.325662-3-tristmd@gmail.com> Content-Language: de-DE From: Christian Lamparter In-Reply-To: <20260421134929.325662-3-tristmd@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 4/21/26 3:49 PM, Tristan Madani wrote: > From: Tristan Madani > > The bounds check in carl9170_tx_process_status() uses > `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing > 2 extra iterations past valid _tx_status entries when the firmware- > controlled hdr.ext exceeds hdr.len/2. Fix by using the correct > comparison `i >= (cmd->hdr.len / 2)`. > > Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend") > Signed-off-by: Tristan Madani Acked-by: Christian Lamparter > --- > Changes in v3: > - Regenerated from wireless-next with proper git format-patch to > produce valid index hashes (v2 had post-processed index lines). > > Changes in v2: > - No code changes from v1. > > drivers/net/wireless/ath/carl9170/tx.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c > index 59caf1e4b1589..06aaf281655b1 100644 > --- a/drivers/net/wireless/ath/carl9170/tx.c > +++ b/drivers/net/wireless/ath/carl9170/tx.c > @@ -692,7 +692,7 @@ void carl9170_tx_process_status(struct ar9170 *ar, > unsigned int i; > > for (i = 0; i < cmd->hdr.ext; i++) { > - if (WARN_ON(i > ((cmd->hdr.len / 2) + 1))) { > + if (WARN_ON(i >= (cmd->hdr.len / 2))) { > print_hex_dump_bytes("UU:", DUMP_PREFIX_NONE, > (void *) cmd, cmd->hdr.len + 4); > break;