From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5326332B10D for ; Tue, 4 Aug 2026 07:25:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785828324; cv=none; b=Cw0Wk7bnRJ1PkrLmkNOj0XHK4e6kV1pcV5jnkf7/J2yIf7s943hv6VkmGoU4zQOpfdB2oxM21leoT9HyN6B3nFmQXTl2oZrckvUSIPmDb6EsLa57+ZewpXd3AVw1UWJfcHRx07zU4UhRUV6Uc3Q/HunnukeUQT4L8u6Hz6QgExs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785828324; c=relaxed/simple; bh=CmmKILoUf4Nc1iA9ndr87Xgs46tBgUoaAOdOPtTjMok=; h=From:Date:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Qzeo9tWdtMDX6I0ZE7mNpMgMRaUi6/Q1rsei6peU7639tO4Iew6iLPIUX1K5ecrAgdEeGlYcCmr0tRFCDmnDeLfMfP2qSfDuZQhXpKcRujkvIGM4F1ergI0Qaaj+wFkbOtv/oqeGw6Mgpw6Lol1RiMsFnwE8NnAGsZYrCU4v0wY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HGpLCbtD; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HGpLCbtD" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cbb662575d3so2367137a12.0 for ; Tue, 04 Aug 2026 00:25:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785828323; x=1786433123; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=D8wLoGKL62KWsMJjZ0jpxf6dNKR9Bv91d9plaxwlCI4=; b=HGpLCbtDWLpb4lnej4u3cwZcDFq4XPNd7ds8wdulA7Tsorc1CEuT2/I8y2lcy3ZoTm 19fot9ItnKdvRN+TIL3ydolqDeNrpuIyIXvjV2Sk1nHRoGBtYK/NzjMFLsJR3XFutWzf VF7s7KI8UT3oFE70ahjGFb4uJsjz7X9ykMzwGQCeFpaUVKQEBaBu5FlBiGUTFdEy1ssj Ot4cKmjwA2nzrFDISeqMhK9vp7ObwtNzZ9QEeaKuMdc2uFlIgAGNm3zGqzD8I0EVzdYR YsAIbrHmIGp+R3mVCr7Tj+iSOpUYYyJucWeXmLyYkd1OB4ygG05kABzCeugFMlpBJ9q9 1tqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785828323; x=1786433123; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=D8wLoGKL62KWsMJjZ0jpxf6dNKR9Bv91d9plaxwlCI4=; b=e0E+bbR0jgj+JaT6d7qReEkYOTSCJEUNf9hf//V+20NlmrDlrmAySF85tPR/AqDXs/ GBns6+zFmQ1ZwP9+8BosNrj8nza4G0RkTbdn9AMy8/1leklfkyYRS6DechPDnvkCB7JU EdeytOvogYR8QzfyM7dceCndlJknzsxX+2md1Sw10emg++/yGjHHeMIuEr3EPemzFkqo p8HC2r+e/MClQm/gvzALolrFt/1HdA5R1rtkDRAUiMrzu0TIhZFxRuG2IcVDyluWge1w 1sjtpfm+W8V+WxUrnEirHInNWs6MbLsLqyDijpYw8m5bN+5ZO6S2adkOrPKjJwZSKFdb UDdw== X-Forwarded-Encrypted: i=1; AHgh+RogHbgj0Mh6AllPaqA/qcCFNXaDCXlosdyNaP2I0zkvmOGsiddVHTb+CDwD7/xJP5Zhlg5DTuGjJUiRC6c=@vger.kernel.org X-Gm-Message-State: AOJu0YzOv+Pf+o4ftXjEPes75E5oMjuS7VW9BcDk/15Nopnsu7tsbT7y Rd4WBNCrjhEiUAj/gx83zqzCJEwEFR6KMcMcRGVUdgvawOdjZakxBqLkAaUJKCdto8c= X-Gm-Gg: AR+sD11kPxUDBUI2okQg4jhIE6SQnlUZCkDJUUtsH8sKr9BCNFTL0YSIumaAhRnWye/ otm1xyp4XlTaw8k7nnpNs3X6P7Yc/IzqbAeEPAJkrTKwCdBBOai2uX+CCFvFMTP95XOpu6mf7+r k/aRCrOHCU6PYrguLq9k3cE0F4oStsvK/SBK7Johp56U+3EmKTARmzwFBej0/PJk1+FJO52YXxI un9j8SVbFecwypzvMVVTzZvTwurOXaxOqeEKkYmIa7tYAY3s6+6tKyOjuMl+kIsapZaMT+/oRve SQbA0sJjRJcnUFihvlkdt7XqamE8b+v4d7LyWkSX8DckoYw6Nc0rk6/16bMF5kOArm6QT/QJBMZ DyCq/y1+wGrV8zS5+G63IXDcVIzxSCQkW0OkWrpi5a4+Ekyt6v3RIypMXS4B7kvElTbih2q8V4f yDb0XP4ldeeJnguOQOEnJlqAPcTrNt6TeoY3riLl/AAMJ+7BujQ5r401+0OdpVr2ZjeUxurwKc5 H/qJ2R8dgTmQC+7EmMq3/Wtwqm31h7M3FiH8N/zfG3kdFLDbmG5Rg== X-Received: by 2002:a05:6a21:7002:b0:3bf:7ab7:98a4 with SMTP id adf61e73a8af0-3c92a833c05mr13846710637.27.1785828322718; Tue, 04 Aug 2026 00:25:22 -0700 (PDT) Received: from nxpwireless-Inspiron-14-Plus-7440 (61-228-234-35.dynamic-ip.hinet.net. [61.228.234.35]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe396ea598sm4746025a12.19.2026.08.04.00.25.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 00:25:21 -0700 (PDT) From: Jeff Chen X-Google-Original-From: Jeff Chen Date: Tue, 4 Aug 2026 15:25:17 +0800 To: Linmao Li Cc: Francesco Dolcini , Johannes Berg , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] wifi: nxpwifi: bound uAP association event IEs to the event buffer Message-ID: References: <20260729082457.1897303-1-lilinmao@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260729082457.1897303-1-lilinmao@kylinos.cn> On Wed, Jul 29, 2026 at 04:24:57 PM +0800, Linmao Li wrote: > nxpwifi_uap_event_sta_assoc() exposes the association request IEs that > the firmware reports in the uAP association event, which the driver > copies into the fixed-size event_body[] buffer. > > event->len is supplied by firmware and is not validated. A value smaller > than the header underflows the subtraction used for assoc_req_ies_len, > while a larger value can make the IE range extend beyond event_body[]. > Subsequent IE parsing can then read past the adapter object. > > Validate both bounds before using the firmware-reported length. > > nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi: > mwifiex: bound uAP association event IEs to the event buffer") and > retains the same unchecked length. Apply the equivalent bounds check > here. > > Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") > Signed-off-by: Linmao Li > --- Reviewed-by: Jeff Chen