Hello.

I found that your patch was applied. But since the reproducer tested only 0 byte
case, I think that rejecting only less than sizeof(struct htc_frame_hdr) bytes
is not sufficient.

More complete patch with Ack from Toke is waiting at
https://lkml.kernel.org/r/7acfa1be-4b5c-b2ce-de43-95b0593fb3e5@I-love.SAKURA.ne.jp .

Please consider overriding with my version.

On 2022/08/24 22:30, Alexander Potapenko wrote:

(adding back people originally CCed on the syzkaller bug.
Unfortunately it isn't possible to reply to all in Google Groups)

On Wed, Aug 24, 2022 at 3:26 PM Alexander Potapenko wrote:

quoted

This bug bites us quite often on syzbot: https://syzkaller.appspot.com/bug?id=659ddf411502a2fe220c8f9be696d5a8d8db726e (17k crashes)
The patch below by phil@philpotter.co.uk (https://syzkaller.appspot.com/text?tag=Patch&x=173dcb51d00000) seems to fix the problem, but I have no idea what's going on there.

==============================================================

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 510e61e97dbc..9dbfff7a388e 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c

@@ -403,7 +403,7 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
     struct htc_endpoint *endpoint;
     __be16 *msg_id;

-    if (!htc_handle || !skb)
+    if (!htc_handle || !skb || !pskb_may_pull(skb, sizeof(struct htc_frame_hdr)))
         return;

     htc_hdr = (struct htc_frame_hdr *) skb->data;

==============================================================