diff options
| author | Tristan Madani <tristan@talencesecurity.com> | 2026-04-21 13:49:28 +0000 |
|---|---|---|
| committer | Jeff Johnson <jeff.johnson@oss.qualcomm.com> | 2026-07-13 06:55:20 -0700 |
| commit | a1a21995c2e1cc2ca6b2226cfe4f5f018370182a (patch) | |
| tree | 49d60ade05d64c9be0c036403c6ab5a3559f2268 /include/linux | |
| parent | a3f42f1049ad80c65560d2b078ad426c3134f78d (diff) | |
wifi: carl9170: fix buffer overflow in rx_stream failover path
The failover continuation in carl9170_rx_stream() copies the full tlen
from the second USB transfer instead of capping at rx_failover_missing
bytes. When both transfers are near maximum size, the total exceeds the
65535-byte failover SKB, triggering skb_over_panic.
Limit the copy size to the missing byte count.
Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac
Link: https://patch.msgid.link/20260421134929.325662-4-tristmd@gmail.com
[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions