From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF8E13E317C for ; Thu, 23 Jul 2026 09:23:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784798608; cv=none; b=EjMTB1LifyDeBcTaIAOvuHc8ZcE/hLkPElQ5T+e2Sgb3c47IVEA8S4rd03oiozfHDLPwM47M1+rJ2neKzZZ8t13dzAlL2Ptzok0j0wQnl3/+2McjS4wZNJ554FsmE3ZaYuzpiRQNPsTUsQnQnSalqaJPznj6NwtoUYEx9gJZtOY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784798608; c=relaxed/simple; bh=UuWU14RrqrYHqcamOKypXwqzu8lVvpVuj0zo7lDdmrQ=; h=From:Date:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=QgBHZL27wlhZ+6LfkgZx2hQahJPMIOKaQERnDGtCZOHYHUIvot/8m6uBF500L7m8hmP1YH/k2yvdI76ub5kPbSIiB50HVK2hEg8EiTs1nOCxS/QTsGz37uR5EjzLBP/Az9EuHGxqMzbKL8WTlsHJPyqBueUfvM1YBUofdRBJBRs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=slropv/e; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="slropv/e" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-c966b9ee9cbso282317a12.1 for ; Thu, 23 Jul 2026 02:23:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784798606; x=1785403406; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=s+63IXBW/hPn74oYRNKsdJ0IozU9pSKHV5tOID1oTJM=; b=slropv/eSl3NzMNA+UPCgDqwK8H7LvCJEjrEnaUL5Z2Z1E+CfSVzp7GKNm5WlS3V7G U7IPXH49ic3U+oEUFPrXSdnzsHAOhIsqEpuxs3Jg1ClgLz1n+hdBpZlv4NaF+ZH1Rbjt SyLvQteeWRJjhpLXdo3WLBmxLuA2x0DgySuXauolKxF7ILdgYNA53+fGcmBBhobteUOi N9opYK1fOusvafu9rJtv2MACIYtcsn6unUItxovalmOj1m/FOrMUz6ofmU07P2UaNh7m GWab7P1DZPl0tkVnTXMxPxj4QVNG5DXbELN+2VLpncZmxeYsv4IbRcdHBnayHKoqasH6 nXpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798606; x=1785403406; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=s+63IXBW/hPn74oYRNKsdJ0IozU9pSKHV5tOID1oTJM=; b=so8CHZ5epiB+LJupJKixJagLXBjmI6zlgG9Mm/KI4T/t0XFZkNWfwgyDNziB83S2ZK pfsvkMqprrHLZUrFpLf87mhkttXt0QOu4MeKZl4CUqsT+tdnwLLoZJgsIv2yR7ir4V4e m3RUezYNp4fKae1gPY6LVZZftM73a/WPb2qrbIWoiR7FjXzLRpSdnewSxcfgjcgZ4aNu zpQDHEIUMLxQMXbgQDAMrBR7thXU90C6ksvLZTysHstY1oBSwK8oXZN6CAAjvH5TsiJu KoWcClB0RpaLWYCWrmpbhqAv2RrWwE9r13KPjr0lNhmjeH2npfy8uOa1HnI9UhUqtW6Q JpEg== X-Forwarded-Encrypted: i=1; AHgh+Rq09HdQVAmYAccSQRuUcqrKhxBZuUVJgkOz5vJRTWkyVWK5/NU5+JCr049AqLDg4Pb+H62fmAAHDm6q3gI=@vger.kernel.org X-Gm-Message-State: AOJu0YwVhRDuJu6+lBf8MJ2PMPBri/638ZC0ohHf3eCSX4tA26IvPjDW Rm0GbcsBLWHBy9j8kbvc5HfdX6yCkVYhER3IAvmswwc8Q24Y2ckYT7Yi X-Gm-Gg: AR+sD12NIOBzAhZyTwsCi/b7fSd0ReKLKbIaijXxbmPW/slKP1F7xRuKSLIDxcyrFAT 6ugxdAX+9qFWQcnckNjl9d2ulV9nDh0p/Z5Tv5OewAJ3H4cMdZf4xQUAB/MJlACxcSKzwpis4R1 bcpR0M/YIj01/rcNvd7lfoQ7zo+tMD1pQj8BlZGXq0Kit0tIjNZMQvDKKjyCI+NYHZ3iNmp8WZt Sqj6PpvLiwEp9DJ4z5XsDCr4/aUR4XI87alVPYxsYTTGnDUdnsS1NAxIKo4ThqVccq6MiU6ipFd 1YdIL1BC267t4/geZu2cenu1HmwEvIjb467KxXhqTCwtSNSLzU4ub/vXkfYMXr1ZADZhVA9ylUP V7JhGZ1T16+lh5AGcLcYweHFqGpbvfC1v/8qz0McHmuj0eNwN+v8ZtzBS1fWa9tQ8InHEi5eoz9 MKGIgp8NM8UdE2Zo+Q7pLbSus8rxhClwJUA6bE3jKIOjCYzN+g0ZRsLsPUKYd8OuqyRu+i+0nNJ YAFHAI= X-Received: by 2002:a05:6300:95:b0:3c4:42d9:58e3 with SMTP id adf61e73a8af0-3c44afcd237mr2411249637.13.1784798605970; Thu, 23 Jul 2026 02:23:25 -0700 (PDT) Received: from nxpwireless-Inspiron-14-Plus-7440 (61-228-225-163.dynamic-ip.hinet.net. [61.228.225.163]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbb8f18c39csm2406904a12.15.2026.07.23.02.23.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:23:25 -0700 (PDT) From: Jeff Chen X-Google-Original-From: Jeff Chen Date: Thu, 23 Jul 2026 17:23:23 +0800 To: Pengpeng Hou Cc: Brian Norris , Francesco Dolcini , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3] wifi: mwifiex: validate event lengths before copying bodies Message-ID: References: <20260723103510.3-mwifiex-event-v3-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260723103510.3-mwifiex-event-v3-pengpeng@iscas.ac.cn> On Thu, Jul 23, 2026 at 10:40:05 AM +0800, Pengpeng Hou wrote: > mwifiex event packets contain a four-byte event cause followed by the > event body. The USB and SDIO paths copy from data after that header using > the full packet length, so the source range extends four bytes beyond the > skb. The SDIO path also reads the event cause before validating the > packet and publishes oversized events without a copied body. > > Reject SDIO events that are shorter than the header or larger than the > event buffer limit. Discard them through the same free-and-break contract > used for unknown upload types. Retain USB's existing error path and copy > only the bytes after the event header in both paths. > > Signed-off-by: Pengpeng Hou > --- > Changes since v2: https://lore.kernel.org/all/20260720115119.80059-1-pengpeng@iscas.ac.cn/ > - replace the new SDIO return -1 with free plus break as requested > - preserve USB's established error return contract > - rebase onto the current wireless tree > > diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c > index f039d6f19183..3588c36f64cf 100644 > --- a/drivers/net/wireless/marvell/mwifiex/sdio.c > +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c > @@ -1712,12 +1712,19 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter, > case MWIFIEX_TYPE_EVENT: > mwifiex_dbg(adapter, EVENT, > "info: --- Rx: Event ---\n"); > + if (skb->len < MWIFIEX_EVENT_HEADER_LEN || > + skb->len > MAX_EVENT_SIZE) { > + mwifiex_dbg(adapter, ERROR, > + "EVENT: invalid skb->len %u\n", skb->len); > + dev_kfree_skb_any(skb); > + break; > + } skb->len includes the 4-byte header, so the body size is skb->len - MWIFIEX_EVENT_HEADER_LEN. The upper bound should be: skb->len - MWIFIEX_EVENT_HEADER_LEN > MAX_EVENT_SIZE Otherwise packets with a full MAX_EVENT_SIZE body are incorrectly rejected.