Re: [PATCH v4] wifi: mwifiex: validate event lengths before copying bodies

On Fri, Jul 31, 2026 at 10:20:02PM +0800, Pengpeng Hou wrote:
> mwifiex event packets contain a four-byte event cause followed by the
> event body. The USB and SDIO paths copy from data after that header using
> the full packet length, so the source range extends four bytes beyond the
> skb. The SDIO path also reads the event cause before validating the
> packet and publishes oversized events without a copied body.
> 
> Reject SDIO events that are shorter than the header or whose body exceeds
> the event buffer. Discard them through the same free-and-break contract
> used for unknown upload types. Retain USB's existing error path, apply the
> same body-length upper bound there, and copy only the bytes after the event
> header in both paths.
> 
> Reviewed-by: Francesco Dolcini <[email protected]>
> Signed-off-by: Pengpeng Hou <[email protected]>

Acked-by: Brian Norris <[email protected]>