Re: [PATCH] wifi: nxpwifi: bound uAP association event IEs to the event buffer

[Jeff Chen <chunfan.chen@gmail.com>]

On Wed, Jul 29, 2026 at 04:24:57 PM +0800, Linmao Li wrote:
> nxpwifi_uap_event_sta_assoc() exposes the association request IEs that
> the firmware reports in the uAP association event, which the driver
> copies into the fixed-size event_body[] buffer.
> 
> event->len is supplied by firmware and is not validated. A value smaller
> than the header underflows the subtraction used for assoc_req_ies_len,
> while a larger value can make the IE range extend beyond event_body[].
> Subsequent IE parsing can then read past the adapter object.
> 
> Validate both bounds before using the firmware-reported length.
> 
> nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi:
> mwifiex: bound uAP association event IEs to the event buffer") and
> retains the same unchecked length. Apply the equivalent bounds check
> here.
> 
> Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
> ---

Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>