Patch "wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-ath9k-fix-potential-stack-out-of-bounds-write-i.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a81281bc9b25cadea558a83b8bc3b8bfbe71d888
Author: Minsuk Kang <linuxlovemin@xxxxxxxxxxxx>
Date:   Wed Jan 4 21:41:30 2023 +0900

    wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
    
    [ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ]
    
    Fix a stack-out-of-bounds write that occurs in a WMI response callback
    function that is called after a timeout occurs in ath9k_wmi_cmd().
    The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that
    could no longer be valid when a timeout occurs. Set wmi->last_seq_id to
    0 when a timeout occurred.
    
    Found by a modified version of syzkaller.
    
    BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx
    Write of size 4
    Call Trace:
     memcpy
     ath9k_wmi_ctrl_rx
     ath9k_htc_rx_msg
     ath9k_hif_usb_reg_in_cb
     __usb_hcd_giveback_urb
     usb_hcd_giveback_urb
     dummy_timer
     call_timer_fn
     run_timer_softirq
     __do_softirq
     irq_exit_rcu
     sysvec_apic_timer_interrupt
    
    Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
    Signed-off-by: Minsuk Kang <linuxlovemin@xxxxxxxxxxxx>
    Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>
    Signed-off-by: Kalle Valo <quic_kvalo@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@xxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index e7a3127395be9..deb22b8c2065f 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -338,6 +338,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
 	if (!time_left) {
 		ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
 			wmi_cmd_to_name(cmd_id));
+		wmi->last_seq_id = 0;
 		mutex_unlock(&wmi->op_mutex);
 		return -ETIMEDOUT;
 	}