This series fixes some bugs in ath9k reported and tested by syzbot. https://lore.kernel.org/linux-usb/000000000000666c9c05a1c05d12@xxxxxxxxxx https://lore.kernel.org/linux-usb/0000000000003d7c1505a2168418@xxxxxxxxxx https://lore.kernel.org/linux-usb/0000000000006ac55b05a1c05d72@xxxxxxxxxx https://lore.kernel.org/linux-usb/0000000000000002fc05a1d61a68@xxxxxxxxxx https://lore.kernel.org/linux-usb/000000000000590f6b05a1c05d15@xxxxxxxxxx Qiujun Huang (5): ath9k: Fix use-after-free Read in htc_connect_service ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx ath9k: Fix use-after-free Write in ath9k_htc_rx_msg ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb drivers/net/wireless/ath/ath9k/hif_usb.c | 58 ++++++++++++++----- drivers/net/wireless/ath/ath9k/hif_usb.h | 6 ++ drivers/net/wireless/ath/ath9k/htc_drv_init.c | 10 +++- drivers/net/wireless/ath/ath9k/htc_hst.c | 6 +- drivers/net/wireless/ath/ath9k/wmi.c | 6 +- drivers/net/wireless/ath/ath9k/wmi.h | 3 +- 6 files changed, 67 insertions(+), 22 deletions(-) -- 2.17.1
