Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <4933455600e633c8cbafc0fc3180a7023894f8c9.camel@sipsolutions.net>
Subject: Re: [PATCH v8] wifi: mwifiex: Fix OOB and integer underflow when rx
 packets
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Polaris Pi <pinkperfect2021@gmail.com>, matthewmwang@chromium.org,
        briannorris@chromium.org, kuba@kernel.org, kvalo@kernel.org
Cc:     linux-wireless@vger.kernel.org
Date:   Thu, 10 Aug 2023 09:32:57 +0200
In-Reply-To: <20230809215817.3080280-1-pinkperfect2021@gmail.com>
References: <20230809215817.3080280-1-pinkperfect2021@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Precedence: bulk

On Wed, 2023-08-09 at 21:58 +0000, Polaris Pi wrote:
> Make sure mwifiex_process_mgmt_packet,
> mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
> mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
> not out-of-bounds access the skb->data buffer.
>=20
> Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80=
211")
> Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
> ---
> V5: Follow chromeos comments: preserve the original flow of mwifiex_proce=
ss_uap_rx_packet
> V6: Simplify check in mwifiex_process_uap_rx_packet
> V7: Fix drop packets issue when auotest V6, now pass manual and auto test=
s
> V8: Fix missing return after free skb
>=20

Arguably, as Brian also said, that missing return is completely
unrelated and should perhaps be a separate commit?

johannes