Re: [PATCH] wifi: nxpwifi: bound uAP association event IEs to the event buffer
Jeff Chen <[email protected]>
| Newsgroups | gmane.linux.kernel.wireless.general,gmane.linux.kernel |
|---|---|
| Message-ID | <anGT3QbxuUSLCvCe@nxpwireless-Inspiron-14-Plus-7440> |
On Wed, Jul 29, 2026 at 04:24:57 PM +0800, Linmao Li wrote:
> nxpwifi_uap_event_sta_assoc() exposes the association request IEs that
> the firmware reports in the uAP association event, which the driver
> copies into the fixed-size event_body[] buffer.
>
> event->len is supplied by firmware and is not validated. A value smaller
> than the header underflows the subtraction used for assoc_req_ies_len,
> while a larger value can make the IE range extend beyond event_body[].
> Subsequent IE parsing can then read past the adapter object.
>
> Validate both bounds before using the firmware-reported length.
>
> nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi:
> mwifiex: bound uAP association event IEs to the event buffer") and
> retains the same unchecked length. Apply the equivalent bounds check
> here.
>
> Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
> Signed-off-by: Linmao Li <lilinmao-UOlijcLmZ/[email protected]>
> ---
Reviewed-by: Jeff Chen <[email protected]>