Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 10 Aug 2023 16:54:14 -0700
From:   Brian Norris <briannorris@chromium.org>
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     Polaris Pi <pinkperfect2021@gmail.com>, matthewmwang@chromium.org,
        kuba@kernel.org, kvalo@kernel.org, linux-wireless@vger.kernel.org
Subject: Re: [PATCH v8] wifi: mwifiex: Fix OOB and integer underflow when rx
 packets
Message-ID: <ZNV4piNiozRcGRYo@google.com>
References: <20230809215817.3080280-1-pinkperfect2021@gmail.com>
 <4933455600e633c8cbafc0fc3180a7023894f8c9.camel@sipsolutions.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4933455600e633c8cbafc0fc3180a7023894f8c9.camel@sipsolutions.net>
Precedence: bulk

On Thu, Aug 10, 2023 at 09:32:57AM +0200, Johannes Berg wrote:
> On Wed, 2023-08-09 at 21:58 +0000, Polaris Pi wrote:
> > Make sure mwifiex_process_mgmt_packet,
> > mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
> > mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
> > not out-of-bounds access the skb->data buffer.
> > 
> > Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211")
> > Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
> > ---
> > V5: Follow chromeos comments: preserve the original flow of mwifiex_process_uap_rx_packet
> > V6: Simplify check in mwifiex_process_uap_rx_packet
> > V7: Fix drop packets issue when auotest V6, now pass manual and auto tests
> > V8: Fix missing return after free skb
> > 
> 
> Arguably, as Brian also said, that missing return is completely
> unrelated and should perhaps be a separate commit?

I think the key here is that Polaris's buggy patch has already been
applied, so this v8 doesn't really work. He has since submitted a proper
fixup patch that applies appropriately, and I've Ack'd that.

Brian