Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <107da8d2ff2610d14cae36124d24fd55eaee469b.camel@sipsolutions.net>
Subject: Re: [PATCH v8] wifi: mwifiex: Fix OOB and integer underflow when rx
 packets
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Brian Norris <briannorris@chromium.org>
Cc:     Polaris Pi <pinkperfect2021@gmail.com>, matthewmwang@chromium.org,
        kuba@kernel.org, kvalo@kernel.org, linux-wireless@vger.kernel.org
Date:   Fri, 11 Aug 2023 12:02:14 +0200
In-Reply-To: <ZNV4piNiozRcGRYo@google.com>
References: <20230809215817.3080280-1-pinkperfect2021@gmail.com>
         <4933455600e633c8cbafc0fc3180a7023894f8c9.camel@sipsolutions.net>
         <ZNV4piNiozRcGRYo@google.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Precedence: bulk

On Thu, 2023-08-10 at 16:54 -0700, Brian Norris wrote:
> On Thu, Aug 10, 2023 at 09:32:57AM +0200, Johannes Berg wrote:
> > On Wed, 2023-08-09 at 21:58 +0000, Polaris Pi wrote:
> > > Make sure mwifiex_process_mgmt_packet,
> > > mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
> > > mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
> > > not out-of-bounds access the skb->data buffer.
> > >=20
> > > Fixes: 2dbaf751b1de ("mwifiex: report received management frames to c=
fg80211")
> > > Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
> > > ---
> > > V5: Follow chromeos comments: preserve the original flow of mwifiex_p=
rocess_uap_rx_packet
> > > V6: Simplify check in mwifiex_process_uap_rx_packet
> > > V7: Fix drop packets issue when auotest V6, now pass manual and auto =
tests
> > > V8: Fix missing return after free skb
> > >=20
> >=20
> > Arguably, as Brian also said, that missing return is completely
> > unrelated and should perhaps be a separate commit?
>=20
> I think the key here is that Polaris's buggy patch has already been
> applied, so this v8 doesn't really work. He has since submitted a proper
> fixup patch that applies appropriately, and I've Ack'd that.
>=20

Right, sorry, I missed that, was looking only at wireless, not wireless-
next.

Thanks all, I'll leave the -next patches for Kalle though :)

johannes