From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 012F6421239 for ; Tue, 4 Aug 2026 07:32:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785828754; cv=none; b=soZ/8IaspTeJZePP5cKITKBSGnufPSdVfp2ogU8ajP8BbQqBBMrwuxsGFNRx0/CCTHHYccauR04xOs2SEBxOuUiDPGtl5d68UMvhYIUw6QDUHnSkCRIaR8ARF5oMAbLkAIy4Owfr0VDfy2d2azo1xwAMjq8nbnA4n9I2bXOyaa0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785828754; c=relaxed/simple; bh=5XbyqdSXJW430fZo6N7HhdFgzjvc9wvvFOLKHbMhF9A=; h=From:Date:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=nX4Lb2VVZq2+M/I10qZJOXX/RUJ+P55+rvXdxbAQ28a8z37GmAQvL/llSDkfnBgyQgAsOsrhYwxqNeCI/n4o8mUM4gJYtX7TKKvKHvAlO7p+sWUAp/Hx5/GHDlw8j1Wb7ucrOzsmBBHUQb0d2ecL0FJtzDQ0GiDE6CjriW+2mHc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nxU9Jr28; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nxU9Jr28" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2cfff5f88dbso49729325ad.3 for ; Tue, 04 Aug 2026 00:32:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785828752; x=1786433552; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=H7MYhIOz/hkty8mHdFJ53ZWzkbrLjBJWCvFkcesm7rs=; b=nxU9Jr28qEwK0n4BBdmcS/R2X0E0UbIr3pJqGqZ+VjwbM6t4/P5wkFHjWO9dQa9jgr qNOjew1aX2maAcVR7tP2Apdm3tDmlNO06HAT6+JBQkTYl5N4nCAYff0MHtazxaxG2ysD UUeo4vJqJlHUEktJbtYfADbBC+ArPyp8hf2yRgAXbOcuY9HcZdncAb18MAHC2pn3Ivul kl/kz1FZUHWA800ZZhkf8gKZhtBcVx2M3K8S0Fksr5dRXYY0v84xmq1Bh3/n2jObzMn3 dK1EfTgI2L1xusJJGiRQbzVjT7iqpefhRXfxx1vd5BCLzlgSZLEVqJUgZgG0pFhcEKAw 8Hvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785828752; x=1786433552; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=H7MYhIOz/hkty8mHdFJ53ZWzkbrLjBJWCvFkcesm7rs=; b=QdKFu/+9yOdGCJtkXq1dAEkYsHx+ZvNIm6uNT5sMgHmCt3Bm9u3wd6QF6l1wngG9ky 4sBsbve8iWP7yRovVmyL2sXyDHAszLH9VUQmj9NM0wjZtwIvWFnVpIMcFYEjtL/7s6fG 9jIdoHShnLD/B68ku4j26o2kUT79VnO1LkR5nd+SlEukBP8Nl4YoIMhhopeN75fYdDyG KogozqiiIv2b8AAUe8CLOxYGCZMc4yAFKY/vYhbWFN06FrPhMeIOMNK31+W3BHi7Br+0 bciBZe6OIO0moq8/bQ/xjfmYJNvydJguUTZWZSWAWbkSZpm+28at5FQl5VH+PM7SXZpw v6yw== X-Forwarded-Encrypted: i=1; AHgh+Rqc7tpHrPKy++fnFcx+A/1TKJE/r+qEcT+Dprkd1fEPLik6lTGUSOBWMZirVc/ByXto/2jAgkd9sNu8+ks=@vger.kernel.org X-Gm-Message-State: AOJu0Yy5+Cu/ry8Ck8n/PyT2WRg6kNKwGNUh8tW9H3kGsbz4kuTcietR BatwJjkqLGWUQsVs5mcwqEr/rlcH16A1MjOMhUYSkuq2qBQbWfz9X8WZ X-Gm-Gg: AR+sD103jmgCZqaJSN1cz1QARJ6X3k6UoMy7zgalD0Kdmj66mS99djBeqcGIkzrr3yX kCdDkP40eaa5MdPlCNgB4PhtGiAlyWEWA1Z+U6e0C9rir77fdJ4EPX9fu/6SAKY+iOSgyLXWNZR La9BQ7OuKRpvnoT7lBUgWyHM8VHdafqiDRUtjtpKJEXKqKqppgt+kXJjqmpLa53yljDsC5wNVuG LG6pZIkwPmqLzmKv+lRmV2Gz7I6dNNoPGYvJDASgC0AbPWuS5aKw99WpV4rxb3Tj8kgiHG5gtAH /GH4xyvamAb/XrcIU5lFPN8JOUeKXjKXav5HcB+4foVtN3TrXGr6823CBLhjhvIn6L4WIpHAalK ECLfX3tvsk7gX+AirGT+glkm20XashhYgqHPS9NwZwalqEuCGr3Lij6rZ9olcTERRGbYDQZgsJn 1jj+7ZC0hUmK7lZ7sVBDH6AptnR7oOOlXUKVvO8I55WYH7Sb3wEimdsb49tNuwyGeA5Ghx0nNb4 K4xb3mrnqzt+PepBSd9lyv4fuK/PHfRPCoJBF0zBiyIJ20w8cwz X-Received: by 2002:a17:902:d98e:b0:2cb:3f5b:6663 with SMTP id d9443c01a7336-2d0522023cemr132594225ad.11.1785828752170; Tue, 04 Aug 2026 00:32:32 -0700 (PDT) Received: from nxpwireless-Inspiron-14-Plus-7440 (61-228-234-35.dynamic-ip.hinet.net. [61.228.234.35]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d0aa4d8af6sm1479115ad.74.2026.08.04.00.32.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 00:32:31 -0700 (PDT) From: Jeff Chen X-Google-Original-From: Jeff Chen Date: Tue, 4 Aug 2026 15:32:27 +0800 To: Pengpeng Hou Cc: Brian Norris , Jeff Chen , Francesco Dolcini , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Francesco Dolcini Subject: Re: [PATCH v4] wifi: mwifiex: validate event lengths before copying bodies Message-ID: References: <20260731141600.2-mwifiex-v4-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260731141600.2-mwifiex-v4-pengpeng@iscas.ac.cn> On Fri, Jul 31, 2026 at 10:20:02 PM +0800, Pengpeng Hou wrote: > mwifiex event packets contain a four-byte event cause followed by the > event body. The USB and SDIO paths copy from data after that header using > the full packet length, so the source range extends four bytes beyond the > skb. The SDIO path also reads the event cause before validating the > packet and publishes oversized events without a copied body. > > Reject SDIO events that are shorter than the header or whose body exceeds > the event buffer. Discard them through the same free-and-break contract > used for unknown upload types. Retain USB's existing error path, apply the > same body-length upper bound there, and copy only the bytes after the event > header in both paths. > > Reviewed-by: Francesco Dolcini > Signed-off-by: Pengpeng Hou > --- Reviewed-by: Jeff Chen