wifi: ath9k: reject short WMI command responses

Browse source

ath9k_wmi_rsp_callback() removes the validated WMI header and copies
the number of bytes expected by the waiting command into its response
buffer. A device response shorter than that expectation can therefore
be read beyond the skb payload.

Record -EMSGSIZE for a short response, complete the waiter, and return
the stored status from the command path. This also prevents callers from
consuming stale response bytes as a successful reply.

Fixes: fb9987d0f7 ("ath9k_htc: Support for AR9271 chipset.")
Assisted-by: LLM
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260814075837.20005-1-pengpeng@iscas.ac.cn
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

...

This commit is contained in:

Pengpeng Hou 2026-08-14 15:58:37 +08:00 • committed by Jeff Johnson

parent 1af8dc9ca7

commit 93ce8ea704

2 changed files with 15 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

16

drivers/net/wireless/ath/ath9k/wmi.c

View file

1

drivers/net/wireless/ath/ath9k/wmi.h

View file