Re: [PATCH 2/2] wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

[Christian Lamparter <chunkeey@gmail.com>]

Hi,
On 8/26/26 7:07 PM, Shengzhuo Wei wrote:
> The PDR_INTERFACE_LIST loop only checks that the record start is within
> the entry before reading an entire struct exp_if from it. A truncated
> trailing record makes the if_id/variant reads cross the entry boundary
> into the heap beyond the EEPROM buffer (verified with a KASAN
> reproducer of the loop). The variant also feeds the synth front-end
> selection, so this is not only a leak.
> 
> Advance only while a full record still fits in the entry.
> 
> Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac hardware")
> Cc: stable@vger.kernel.org
> Assisted-by: GLM:5.3
> Signed-off-by: Shengzhuo Wei <me@cherr.cc>

Hmm, sure.

Acked-by: Christian Lamparter <chunkeey@gmail.com>

> ---
>   drivers/net/wireless/intersil/p54/eeprom.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
> index 968ce9a411358e0e6b83117b1a077becc3207090..472edecf55772893afdf8be3020e6baaf80097a5 100644
> --- a/drivers/net/wireless/intersil/p54/eeprom.c
> +++ b/drivers/net/wireless/intersil/p54/eeprom.c
> @@ -817,7 +817,8 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
>   			break;
>   		case PDR_INTERFACE_LIST:
>   			tmp = entry->data;
> -			while ((u8 *)tmp < entry->data + data_len) {
> +			while ((u8 *)tmp + sizeof(struct exp_if) <=
> +			       entry->data + data_len) {
>   				struct exp_if *exp_if = tmp;
>   				if (exp_if->if_id == cpu_to_le16(IF_ID_ISL39000))
>   					synth = le16_to_cpu(exp_if->variant);
>