From: Johannes Berg <johannes@sipsolutions.net>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>,
Brian Norris <briannorris@chromium.org>
Cc: Jeff Chen <chunfan.chen@gmail.com>,
Jeff Chen <jeff.chen_1@nxp.com>,
Francesco Dolcini <francesco@dolcini.it>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
Francesco Dolcini <francesco.dolcini@toradex.com>
Subject: Re: [PATCH v4] wifi: mwifiex: validate event lengths before copying bodies
Date: Thu, 03 Sep 2026 20:59:31 +0200 [thread overview]
Message-ID: <97fdc1b8cff6477217100beb9b242ede810a7dc2.camel@sipsolutions.net> (raw)
In-Reply-To: <20260731141600.2-mwifiex-v4-pengpeng@iscas.ac.cn>
On Fri, 2026-07-31 at 22:20 +0800, Pengpeng Hou wrote:
>
> +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
> @@ -1712,12 +1712,19 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
> case MWIFIEX_TYPE_EVENT:
> mwifiex_dbg(adapter, EVENT,
> "info: --- Rx: Event ---\n");
> + if (skb->len < MWIFIEX_EVENT_HEADER_LEN ||
> + skb->len - MWIFIEX_EVENT_HEADER_LEN > MAX_EVENT_SIZE) {
> + mwifiex_dbg(adapter, ERROR,
> + "EVENT: invalid skb->len %u\n", skb->len);
> + dev_kfree_skb_any(skb);
> + break;
> + }
> +
> adapter->event_cause = get_unaligned_le32(skb->data);
Are you all sure this is right? PCIe still delivers the event w/o the
body if it's too big?
johannes
prev parent reply other threads:[~2026-09-03 18:59 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-31 14:20 Pengpeng Hou
2026-08-04 7:32 ` Jeff Chen
2026-08-11 21:37 ` Brian Norris
2026-09-03 18:59 ` Johannes Berg [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=97fdc1b8cff6477217100beb9b242ede810a7dc2.camel@sipsolutions.net \
--to=johannes@sipsolutions.net \
--cc=briannorris@chromium.org \
--cc=chunfan.chen@gmail.com \
--cc=francesco.dolcini@toradex.com \
--cc=francesco@dolcini.it \
--cc=jeff.chen_1@nxp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=pengpeng@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®