Tristan Madani a1a21995c2 wifi: carl9170: fix buffer overflow in rx_stream failover path ...

The failover continuation in carl9170_rx_stream() copies the full tlen
from the second USB transfer instead of capping at rx_failover_missing
bytes. When both transfers are near maximum size, the total exceeds the
65535-byte failover SKB, triggering skb_over_panic.

Limit the copy size to the missing byte count.

Fixes: a84fab3cbf ("carl9170: 802.11 rx/tx processing and usb backend")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac
Link: https://patch.msgid.link/20260421134929.325662-4-tristmd@gmail.com
[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

2026-07-13 06:55:20 -07:00

..

carl9170.h

carl9170: Avoid -Wflex-array-member-not-at-end warning

2026-01-17 11:00:37 -08:00

cmd.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

cmd.h

…

debug.c

…

debug.h

…

eeprom.h

…

fw.c

…

fwcmd.h

…

fwdesc.h

…

hw.h

…

Kconfig

…

led.c

…

mac.c

…

main.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Makefile

…

phy.c

…

phy.h

…

rx.c

wifi: carl9170: fix buffer overflow in rx_stream failover path

2026-07-13 06:55:20 -07:00

tx.c

wifi: carl9170: fix OOB read from off-by-two in TX status handler

2026-07-13 06:55:19 -07:00

usb.c

wifi: carl9170: do not ping device which has failed to load firmware

2025-06-17 16:28:35 -07:00

version.h

…

wlan.h

…