* [PATCH wireless-next v2 0/2] wifi: mwifiex: append hotfix number to firmware version string @ 2026-10-12 12:36 jeff.chen_1 2026-10-12 12:36 ` [PATCH wireless-next v2 1/2] " jeff.chen_1 2026-10-12 12:36 ` [PATCH wireless-next v2 2/2] wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing jeff.chen_1 0 siblings, 2 replies; 8+ messages in thread From: jeff.chen_1 @ 2026-10-12 12:36 UTC (permalink / raw) To: linux-wireless; +Cc: briannorris, johannes, francesco, Jeff Chen From: Jeff Chen <jeff.chen_1@nxp.com> Changes in v2: - Split TLV validation into a separate patch - Add generic GET_HW_SPEC TLV length validation Jeff Chen (2): wifi: mwifiex: append hotfix number to firmware version string wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing drivers/net/wireless/marvell/mwifiex/cmdevt.c | 22 +++++++++++++++++-- drivers/net/wireless/marvell/mwifiex/fw.h | 6 +++++ drivers/net/wireless/marvell/mwifiex/init.c | 1 + drivers/net/wireless/marvell/mwifiex/main.h | 1 + .../net/wireless/marvell/mwifiex/sta_ioctl.c | 3 ++- 5 files changed, 30 insertions(+), 3 deletions(-) base-commit: fbfa27d9b06f025c5f2cfa79d0e01e6400eeff2a -- 2.34.1 ^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH wireless-next v2 1/2] wifi: mwifiex: append hotfix number to firmware version string 2026-10-12 12:36 [PATCH wireless-next v2 0/2] wifi: mwifiex: append hotfix number to firmware version string jeff.chen_1 @ 2026-10-12 12:36 ` jeff.chen_1 2026-10-19 14:13 ` Francesco Dolcini 2026-10-12 12:36 ` [PATCH wireless-next v2 2/2] wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing jeff.chen_1 1 sibling, 1 reply; 8+ messages in thread From: jeff.chen_1 @ 2026-10-12 12:36 UTC (permalink / raw) To: linux-wireless; +Cc: briannorris, johannes, francesco, Jeff Chen From: Jeff Chen <jeff.chen_1@nxp.com> mwifiex_ret_get_hw_spec() parses and logs the FW_HOTFIX_VER_ID TLV, but the hotfix value is not stored in the adapter structure. As a result, the hotfix number never appears in the firmware version string returned by mwifiex_drv_get_driver_version(). Store the hotfix version from FW_HOTFIX_VER_ID and append it to the firmware version string. Assisted-by: LLM sparse Fixes: 7715d79553de ("wifi: mwifiex: Support firmware hotfix version in GET_HW_SPEC responses") Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com> --- drivers/net/wireless/marvell/mwifiex/cmdevt.c | 10 ++++++++-- drivers/net/wireless/marvell/mwifiex/fw.h | 6 ++++++ drivers/net/wireless/marvell/mwifiex/init.c | 1 + drivers/net/wireless/marvell/mwifiex/main.h | 1 + drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 3 ++- 5 files changed, 18 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c index 29e0f274575e..268a795db486 100644 --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c @@ -1594,11 +1594,17 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, api_rev->major_ver, api_rev->minor_ver); break; - case FW_HOTFIX_VER_ID: + case FW_HOTFIX_VER_ID: { + struct hw_spec_fw_hotfix_ver *hf; + + hf = (void *)tlv; + adapter->fw_hotfix_ver = + le16_to_cpu(hf->hotfix_ver); mwifiex_dbg(adapter, INFO, "Firmware hotfix version %d\n", - api_rev->major_ver); + adapter->fw_hotfix_ver); break; + } default: mwifiex_dbg(adapter, FATAL, "Unknown api_id: %d\n", diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h index 93561116959a..f254d6d6e3eb 100644 --- a/drivers/net/wireless/marvell/mwifiex/fw.h +++ b/drivers/net/wireless/marvell/mwifiex/fw.h @@ -1104,6 +1104,12 @@ struct hw_spec_api_rev { u8 minor_ver; } __packed; +struct hw_spec_fw_hotfix_ver { + struct mwifiex_ie_types_header header; + __le16 api_id; + __le16 hotfix_ver; +} __packed; + struct host_cmd_ds_get_hw_spec { __le16 hw_if_version; __le16 version; diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c index 0c8925013724..e8a5f9b758d6 100644 --- a/drivers/net/wireless/marvell/mwifiex/init.c +++ b/drivers/net/wireless/marvell/mwifiex/init.c @@ -296,6 +296,7 @@ static void mwifiex_init_adapter(struct mwifiex_adapter *adapter) adapter->config_bands = 0; adapter->adhoc_start_band = 0; adapter->fw_release_number = 0; + adapter->fw_hotfix_ver = 0; adapter->fw_cap_info = 0; memset(&adapter->upld_buf, 0, sizeof(adapter->upld_buf)); adapter->event_cause = 0; diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h index 8e6238c01aa6..5dd01bacc7cb 100644 --- a/drivers/net/wireless/marvell/mwifiex/main.h +++ b/drivers/net/wireless/marvell/mwifiex/main.h @@ -1003,6 +1003,7 @@ struct mwifiex_adapter { bool host_mlme_enabled; struct ieee80211_txrx_stypes mwifiex_mgmt_stypes[NUM_NL80211_IFTYPES]; u8 fw_api_ver; + u16 fw_hotfix_ver; u8 key_api_major_ver, key_api_minor_ver; u8 max_p2p_conn, max_sta_conn; struct memory_type_mapping *mem_type_mapping_tbl; diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c index 19196848778c..1d3874734851 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c @@ -1144,7 +1144,8 @@ mwifiex_drv_get_driver_version(struct mwifiex_adapter *adapter, char *version, char fw_ver[32]; ver.l = cpu_to_le32(adapter->fw_release_number); - sprintf(fw_ver, "%u.%u.%u.p%u", ver.c[2], ver.c[1], ver.c[0], ver.c[3]); + sprintf(fw_ver, "%u.%u.%u.p%u.%u", ver.c[2], ver.c[1], + ver.c[0], ver.c[3], adapter->fw_hotfix_ver); snprintf(version, max_len, driver_version, fw_ver); -- 2.34.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH wireless-next v2 1/2] wifi: mwifiex: append hotfix number to firmware version string 2026-10-12 12:36 ` [PATCH wireless-next v2 1/2] " jeff.chen_1 @ 2026-10-19 14:13 ` Francesco Dolcini 2026-10-19 14:16 ` Johannes Berg 0 siblings, 1 reply; 8+ messages in thread From: Francesco Dolcini @ 2026-10-19 14:13 UTC (permalink / raw) To: jeff.chen_1; +Cc: linux-wireless, briannorris, johannes, francesco, Jeff Chen Hello Jeff, thanks for the patch On Mon, Oct 12, 2026 at 08:36:23PM +0800, jeff.chen_1@oss.nxp.com wrote: > From: Jeff Chen <jeff.chen_1@nxp.com> > > mwifiex_ret_get_hw_spec() parses and logs the FW_HOTFIX_VER_ID TLV, > but the hotfix value is not stored in the adapter structure. As a > result, the hotfix number never appears in the firmware version string > returned by mwifiex_drv_get_driver_version(). > > Store the hotfix version from FW_HOTFIX_VER_ID and append it to the > firmware version string. > > Assisted-by: LLM sparse > Fixes: 7715d79553de ("wifi: mwifiex: Support firmware hotfix version in GET_HW_SPEC responses") > Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com> > --- > drivers/net/wireless/marvell/mwifiex/cmdevt.c | 10 ++++++++-- > drivers/net/wireless/marvell/mwifiex/fw.h | 6 ++++++ > drivers/net/wireless/marvell/mwifiex/init.c | 1 + > drivers/net/wireless/marvell/mwifiex/main.h | 1 + > drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 3 ++- > 5 files changed, 18 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c > index 29e0f274575e..268a795db486 100644 > --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c > +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c > @@ -1594,11 +1594,17 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, > api_rev->major_ver, > api_rev->minor_ver); > break; > - case FW_HOTFIX_VER_ID: > + case FW_HOTFIX_VER_ID: { > + struct hw_spec_fw_hotfix_ver *hf; All the other cases in the switch declare the variable at top. I would do the same for consistency here. > + > + hf = (void *)tlv; I would not abuse the void*, you know the type you want hf = (struct hw_spec_fw_hotfix_ver *)tlv > + adapter->fw_hotfix_ver = 0; With this change we will always report `0` as the hotfix version, even when nothing is provided by the fw. Is this generally ok? I assume so, asking just to have an explicit confirmation. Francesco ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH wireless-next v2 1/2] wifi: mwifiex: append hotfix number to firmware version string 2026-10-19 14:13 ` Francesco Dolcini @ 2026-10-19 14:16 ` Johannes Berg 2026-10-19 14:28 ` Francesco Dolcini 0 siblings, 1 reply; 8+ messages in thread From: Johannes Berg @ 2026-10-19 14:16 UTC (permalink / raw) To: Francesco Dolcini, jeff.chen_1; +Cc: linux-wireless, briannorris, Jeff Chen On Mon, 2026-10-19 at 16:13 +0200, Francesco Dolcini wrote: > > > + case FW_HOTFIX_VER_ID: { > > + struct hw_spec_fw_hotfix_ver *hf; > > + > > + hf = (void *)tlv; > > I would not abuse the void*, you know the type you want FWIW, I tend to disagree, spelling out the type again for no real reason is just noise. As far as I'm concerned you can do whatever you like in the driver though :) johannes ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH wireless-next v2 1/2] wifi: mwifiex: append hotfix number to firmware version string 2026-10-19 14:16 ` Johannes Berg @ 2026-10-19 14:28 ` Francesco Dolcini 2026-10-19 14:49 ` Johannes Berg 0 siblings, 1 reply; 8+ messages in thread From: Francesco Dolcini @ 2026-10-19 14:28 UTC (permalink / raw) To: Johannes Berg Cc: Francesco Dolcini, jeff.chen_1, linux-wireless, briannorris, Jeff Chen On Mon, Oct 19, 2026 at 04:16:01PM +0200, Johannes Berg wrote: > On Mon, 2026-10-19 at 16:13 +0200, Francesco Dolcini wrote: > > > > > + case FW_HOTFIX_VER_ID: { > > > + struct hw_spec_fw_hotfix_ver *hf; > > > > + > > > + hf = (void *)tlv; > > > > I would not abuse the void*, you know the type you want > > FWIW, I tend to disagree, spelling out the type again for no real reason > is just noise. As far as I'm concerned you can do whatever you like in > the driver though :) I would say that your opinion trumps mine on this regard. And it changes nothing on the generated binary, in any way. The reason I prefer it is that (void*) will silently cast to everything, and having an explicit type might help in case of mistake introduced with some future refactoring. Jeff, up to you, we can take the patch as it is. And I'd like to have this in the driver, it's something we are missing and it's valuable. Francesco ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH wireless-next v2 1/2] wifi: mwifiex: append hotfix number to firmware version string 2026-10-19 14:28 ` Francesco Dolcini @ 2026-10-19 14:49 ` Johannes Berg 2026-10-19 15:11 ` Francesco Dolcini 0 siblings, 1 reply; 8+ messages in thread From: Johannes Berg @ 2026-10-19 14:49 UTC (permalink / raw) To: Francesco Dolcini; +Cc: jeff.chen_1, linux-wireless, briannorris, Jeff Chen On Mon, 2026-10-19 at 16:28 +0200, Francesco Dolcini wrote: > > Jeff, up to you, we can take the patch as it is. Wait, we're discussing mwifiex, not nxpwifi, didn't I already apply this?! johannes ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH wireless-next v2 1/2] wifi: mwifiex: append hotfix number to firmware version string 2026-10-19 14:49 ` Johannes Berg @ 2026-10-19 15:11 ` Francesco Dolcini 0 siblings, 0 replies; 8+ messages in thread From: Francesco Dolcini @ 2026-10-19 15:11 UTC (permalink / raw) To: Johannes Berg Cc: Francesco Dolcini, jeff.chen_1, linux-wireless, briannorris, Jeff Chen On Mon, Oct 19, 2026 at 04:49:57PM +0200, Johannes Berg wrote: > On Mon, 2026-10-19 at 16:28 +0200, Francesco Dolcini wrote: > > > > Jeff, up to you, we can take the patch as it is. > > Wait, we're discussing mwifiex, not nxpwifi, didn't I already apply > this?! Yes, already merged. Sorry, I missed it, all good. Francesco ^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH wireless-next v2 2/2] wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing 2026-10-12 12:36 [PATCH wireless-next v2 0/2] wifi: mwifiex: append hotfix number to firmware version string jeff.chen_1 2026-10-12 12:36 ` [PATCH wireless-next v2 1/2] " jeff.chen_1 @ 2026-10-12 12:36 ` jeff.chen_1 1 sibling, 0 replies; 8+ messages in thread From: jeff.chen_1 @ 2026-10-12 12:36 UTC (permalink / raw) To: linux-wireless; +Cc: briannorris, johannes, francesco, Jeff Chen From: Jeff Chen <jeff.chen_1@nxp.com> Validate TLV lengths before accessing TLV payloads in mwifiex_ret_get_hw_spec(). Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com> --- drivers/net/wireless/marvell/mwifiex/cmdevt.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c index 268a795db486..6e04d7da6217 100644 --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c @@ -1494,6 +1494,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, struct hw_spec_max_conn *max_conn; u16 resp_size, api_id; int i, left_len, parsed_len = 0; + int tlv_len; adapter->fw_cap_info = le32_to_cpu(hw_spec->fw_cap_info); @@ -1559,8 +1560,16 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, left_len = resp_size - sizeof(struct host_cmd_ds_get_hw_spec); while (left_len > sizeof(struct mwifiex_ie_types_header)) { tlv = (void *)&hw_spec->tlvs + parsed_len; + tlv_len = sizeof(*tlv) + le16_to_cpu(tlv->len); + + if (tlv_len > left_len) + break; + switch (le16_to_cpu(tlv->type)) { case TLV_TYPE_API_REV: + if (tlv_len < sizeof(struct hw_spec_api_rev)) + break; + api_rev = (struct hw_spec_api_rev *)tlv; api_id = le16_to_cpu(api_rev->api_id); switch (api_id) { @@ -1613,6 +1622,9 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, } break; case TLV_TYPE_MAX_CONN: + if (tlv_len < sizeof(struct hw_spec_max_conn)) + break; + max_conn = (struct hw_spec_max_conn *)tlv; adapter->max_p2p_conn = max_conn->max_p2p_conn; adapter->max_sta_conn = max_conn->max_sta_conn; -- 2.34.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-10-19 15:11 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-10-12 12:36 [PATCH wireless-next v2 0/2] wifi: mwifiex: append hotfix number to firmware version string jeff.chen_1 2026-10-12 12:36 ` [PATCH wireless-next v2 1/2] " jeff.chen_1 2026-10-19 14:13 ` Francesco Dolcini 2026-10-19 14:16 ` Johannes Berg 2026-10-19 14:28 ` Francesco Dolcini 2026-10-19 14:49 ` Johannes Berg 2026-10-19 15:11 ` Francesco Dolcini 2026-10-12 12:36 ` [PATCH wireless-next v2 2/2] wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing jeff.chen_1
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.