[for -stable] commit "c82919888064 ath10k: fix scan crash due to incorrect length calculation"

[for -stable] commit "c82919888064 ath10k: fix scan crash due to incorrect length calculation"

[Brian Norris]

Hi Greg / stable maintainer(s),

IIUC, this commit is a good candidate for -stable. I just hit the bug on
4.14, because of new vendor firmware that noticed the mismatched length
(an internal "assert"), but it seems like this is equally problematic
from the kernel side for as long as this code existed [1]:

commit c8291988806407e02a01b4b15b4504eafbcc04e0
Author: Zhi Chen <zhichen@codeaurora.org>
Date:   Mon Jun 18 17:00:39 2018 +0300

    ath10k: fix scan crash due to incorrect length calculation

Thanks,
Brian

[1] I guess that would be:

Fixes: ca996ec56608 ("ath10k: implement wmi-tlv backend")

which was in v4.0.

Re: [for -stable] commit "c82919888064 ath10k: fix scan crash due to incorrect length calculation"

[Kalle Valo]

Brian Norris <briannorris@chromium.org> writes:

> Hi Greg / stable maintainer(s),
>
> IIUC, this commit is a good candidate for -stable. I just hit the bug on
> 4.14, because of new vendor firmware that noticed the mismatched length
> (an internal "assert"), but it seems like this is equally problematic
> from the kernel side for as long as this code existed [1]:
>
> commit c8291988806407e02a01b4b15b4504eafbcc04e0
> Author: Zhi Chen <zhichen@codeaurora.org>
> Date:   Mon Jun 18 17:00:39 2018 +0300
>
>     ath10k: fix scan crash due to incorrect length calculation
>
> Thanks,
> Brian
>
> [1] I guess that would be:
>
> Fixes: ca996ec56608 ("ath10k: implement wmi-tlv backend")
>
> which was in v4.0.

FWIW:

Acked-by: Kalle Valo <kvalo@codeaurora.org>

Thanks Brian!

-- 
Kalle Valo

Re: [for -stable] commit "c82919888064 ath10k: fix scan crash due to incorrect length calculation"

[Greg KH]

On Thu, Sep 06, 2018 at 02:36:22PM -0700, Brian Norris wrote:
> Hi Greg / stable maintainer(s),
> 
> IIUC, this commit is a good candidate for -stable. I just hit the bug on
> 4.14, because of new vendor firmware that noticed the mismatched length
> (an internal "assert"), but it seems like this is equally problematic
> from the kernel side for as long as this code existed [1]:
> 
> commit c8291988806407e02a01b4b15b4504eafbcc04e0
> Author: Zhi Chen <zhichen@codeaurora.org>
> Date:   Mon Jun 18 17:00:39 2018 +0300
> 
>     ath10k: fix scan crash due to incorrect length calculation
> 
> Thanks,
> Brian
> 
> [1] I guess that would be:
> 
> Fixes: ca996ec56608 ("ath10k: implement wmi-tlv backend")
> 
> which was in v4.0.

Thanks, now queued up.

greg k-h