Hello. I found that your patch was applied. But since the reproducer tested only 0 byte case, I think that rejecting only less than sizeof(struct htc_frame_hdr) bytes is not sufficient. More complete patch with Ack from Toke is waiting at https://lkml.kernel.org/r/7acfa1be-4b5c-b2ce-de43-95b0593fb3e5@xxxxxxxxxxxxxxxxxxx . Please consider overriding with my version. On 2022/08/24 22:30, Alexander Potapenko wrote: > (adding back people originally CCed on the syzkaller bug. > Unfortunately it isn't possible to reply to all in Google Groups) > > On Wed, Aug 24, 2022 at 3:26 PM Alexander Potapenko wrote: >> This bug bites us quite often on syzbot: https://syzkaller.appspot.com/bug?id=659ddf411502a2fe220c8f9be696d5a8d8db726e (17k crashes) >> The patch below by phil@xxxxxxxxxxxxxxxx (https://syzkaller.appspot.com/text?tag=Patch&x=173dcb51d00000) seems to fix the problem, but I have no idea what's going on there. >> >> ============================================================== >> diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c >> index 510e61e97dbc..9dbfff7a388e 100644 >> --- a/drivers/net/wireless/ath/ath9k/htc_hst.c >> +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c >> @@ -403,7 +403,7 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, >> struct htc_endpoint *endpoint; >> __be16 *msg_id; >> >> - if (!htc_handle || !skb) >> + if (!htc_handle || !skb || !pskb_may_pull(skb, sizeof(struct htc_frame_hdr))) >> return; >> >> htc_hdr = (struct htc_frame_hdr *) skb->data; >> ============================================================== > >
