Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5;
Message-ID: <fb9f1d68-77a4-0620-10fc-982b83660de8@mcst.ru>
Date:   Thu, 5 Oct 2023 15:31:23 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.1
Subject: Re: [lvc-project] [PATCH] wifi: mac80211: fix buffer overflow in
 ieee80211_rx_get_bigtk()
Content-Language: en-US
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
References: <20231004143740.40933-1-Igor.A.Artemiev@mcst.ru>
 <3ba8e3902ade7483a82bd305a35a236744ffba25.camel@sipsolutions.net>
From:   "Igor A. Artemiev" <Igor.A.Artemiev@mcst.ru>
In-Reply-To: <3ba8e3902ade7483a82bd305a35a236744ffba25.camel@sipsolutions.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 10/4/23 17:58, Johannes Berg wrote:
> And ... how exactly do you propose that is going to happen?

'conf.keyidx', the value that is passed to the function, can be 0. But I 
missed checking the second argument of the ieee80211_rx_get_bigtk() 
function before calling it. Sorry to bother you.

Thanks,
Igor