All of lore.kernel.org
 help / color / mirror / Atom feed
From: Wang Yan <wangyan01@kylinos.cn>
To: chunkeey@gmail.com
Cc: johannes.berg@intel.com, linux-kernel@vger.kernel.org,
	linux-wireless@vger.kernel.org, linville@tuxdriver.com,
	wangyan01@kylinos.cn, zilin@seu.edu.cn
Subject: Re: [PATCH] wifi: p54: fix incorrect length check in p54_find_ie()
Date: Mon,  7 Sep 2026 14:19:01 +0800	[thread overview]
Message-ID: <20260907061901.659866-1-wangyan01@kylinos.cn> (raw)
In-Reply-To: <bdca394f-0371-45ad-bfee-b044444ad724@gmail.com>

Hi Christian,

Thank you for the thorough review and for tracing the issue back to the original commit.

I agree with your analysis. The while loop together with the bounds check inside the loop body already ensures that no IE pointer is returned unless it lies within skb->len, making the initial length check redundant. As you also pointed out, the check itself is incorrect because sizeof(mgmt) evaluates to the pointer size rather than the size of struct ieee80211_mgmt.

I have posted a new patch that removes the superfluous check and updates the Fixes tag to e5ea92a7528d ("p54: AP & Ad‑hoc testing") as you suggested.

Thanks again for the review.

Regards,
Wang Yan

      parent reply	other threads:[~2026-09-07  6:19 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-03  8:12 [PATCH] wifi: p54: fix incorrect frame length check in p54_find_ie() Wang Yan
2026-09-06 11:06 ` Christian Lamparter
2026-09-06 11:49   ` Johannes Berg
2026-09-06 14:24     ` Christian Lamparter
2026-09-06 14:44       ` Johannes Berg
2026-09-07  2:49   ` [PATCH v2] wifi: p54: remove redundant " Wang Yan
2026-09-07  6:19   ` Wang Yan [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260907061901.659866-1-wangyan01@kylinos.cn \
    --to=wangyan01@kylinos.cn \
    --cc=chunkeey@gmail.com \
    --cc=johannes.berg@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=linville@tuxdriver.com \
    --cc=zilin@seu.edu.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.