Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <ca02c01f-6b53-edaf-321f-b9452558dbd3@quicinc.com>
Date:   Thu, 10 Aug 2023 16:14:43 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.14.0
Subject: Re: [PATCH v2] wifi: ath12k: Fix buffer overflow when scanning with
 extraie
Content-Language: en-US
To:     Sven Eckelmann <sven@narfation.org>,
        Jeff Johnson <quic_jjohnson@quicinc.com>,
        <ath12k@lists.infradead.org>
CC:     <linux-wireless@vger.kernel.org>
References: <20230809081241.32765-1-quic_wgong@quicinc.com>
 <3206e181-f770-c599-87e1-364114b9746a@quicinc.com>
 <db119d06-7549-3be9-524f-327485d34da9@quicinc.com>
 <4161316.1IzOArtZ34@ripper>
From:   Wen Gong <quic_wgong@quicinc.com>
In-Reply-To: <4161316.1IzOArtZ34@ripper>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 8/10/2023 4:09 PM, Sven Eckelmann wrote:
> On Thursday, 10 August 2023 06:31:02 CEST Wen Gong wrote:
>> On 8/10/2023 2:16 AM, Jeff Johnson wrote:
>>> On 8/9/2023 10:31 AM, Jeff Johnson wrote:
>>>> On 8/9/2023 1:12 AM, Wen Gong wrote:
>> [...]
>>>> Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
>>> Wen, can you please add a Fixes: tag since based upon the discussion
>>> you actually observed a crash
>>>
>> Jeff, do you mean I should add the crash call stack or other thing in
>> this patch?
> I think a reference to the commit which is fixed should be added.
>
>> The crash is observed by Sven Eckelmann <sven@narfation.org>  on 07 Dec
>> 2021 here:
>> Subject: Re: [PATCH] ath11k: enable
>> IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS for WCN6855
>> https://lore.kernel.org/linux-wireless/3267805.el9kkjlfUZ@ripper/
> This was for ath11k. See my patch for it in
> https://lore.kernel.org/r/20211207142913.1734635-1-sven@narfation.org
> So I doubt that it is ok to add the same backtrace for an ath12k commit.
>
> And if I compare both patches, it looks to me that you don't handle the
> params->extraie.len > 16 bit (see WMI_TLV_LEN) in ath12k.
>
> Kind regards,
> 	Sven

I added similar check here:
[v2] wifi: ath12k: add check max message length while scanning with extraie
https://patchwork.kernel.org/project/linux-wireless/patch/20230809081657.13858-1-quic_wgong@quicinc.com/