[PATCH] wifi: nxpwifi: bound uAP association event IEs to the event buffer

[PATCH] wifi: nxpwifi: bound uAP association event IEs to the event buffer

[Linmao Li]

nxpwifi_uap_event_sta_assoc() exposes the association request IEs that
the firmware reports in the uAP association event, which the driver
copies into the fixed-size event_body[] buffer.

event->len is supplied by firmware and is not validated. A value smaller
than the header underflows the subtraction used for assoc_req_ies_len,
while a larger value can make the IE range extend beyond event_body[].
Subsequent IE parsing can then read past the adapter object.

Validate both bounds before using the firmware-reported length.

nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi:
mwifiex: bound uAP association event IEs to the event buffer") and
retains the same unchecked length. Apply the equivalent bounds check
here.

Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/net/wireless/nxp/nxpwifi/uap_event.c | 22 ++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/nxp/nxpwifi/uap_event.c b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
index ed8e24ae9c0a7..9f717a3d7ec5d 100644
--- a/drivers/net/wireless/nxp/nxpwifi/uap_event.c
+++ b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
@@ -107,11 +107,29 @@ nxpwifi_uap_event_sta_assoc(struct nxpwifi_private *priv)
 			len = ETH_ALEN;
 
 		if (len != -1) {
+			u16 evt_len = le16_to_cpu(event->len);
+
 			sinfo->assoc_req_ies = &event->data[len];
 			len = (u8 *)sinfo->assoc_req_ies -
 			      (u8 *)&event->frame_control;
-			sinfo->assoc_req_ies_len =
-				le16_to_cpu(event->len) - (u16)len;
+
+			/*
+			 * event->len is reported by the device firmware
+			 * and is not otherwise validated. Reject a length
+			 * that underflows the header or that would place
+			 * the association request IEs outside the fixed
+			 * event_body[] buffer.
+			 */
+			if (evt_len < len ||
+			    (u8 *)&event->frame_control + evt_len >
+			    adapter->event_body + MAX_EVENT_SIZE) {
+				nxpwifi_dbg(adapter, ERROR,
+					    "invalid STA assoc event length\n");
+				kfree(sinfo);
+				return -EINVAL;
+			}
+
+			sinfo->assoc_req_ies_len = evt_len - (u16)len;
 		}
 	}
 	cfg80211_new_sta(priv->netdev->ieee80211_ptr, event->sta_addr, sinfo,

base-commit: 3652b49adac266a3d27cb41cdfdb7d8790fc3633
-- 
2.25.1

Re: [PATCH] wifi: nxpwifi: bound uAP association event IEs to the event buffer

[Jeff Chen]

On Wed, Jul 29, 2026 at 04:24:57 PM +0800, Linmao Li wrote:
> nxpwifi_uap_event_sta_assoc() exposes the association request IEs that
> the firmware reports in the uAP association event, which the driver
> copies into the fixed-size event_body[] buffer.
> 
> event->len is supplied by firmware and is not validated. A value smaller
> than the header underflows the subtraction used for assoc_req_ies_len,
> while a larger value can make the IE range extend beyond event_body[].
> Subsequent IE parsing can then read past the adapter object.
> 
> Validate both bounds before using the firmware-reported length.
> 
> nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi:
> mwifiex: bound uAP association event IEs to the event buffer") and
> retains the same unchecked length. Apply the equivalent bounds check
> here.
> 
> Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
> ---

Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>