Re: [PATCH] wifi: mwifiex: copy only event bodies after headers

[Francesco Dolcini <francesco@dolcini.it>]

On Sat, Jul 04, 2026 at 09:13:17AM +0800, Pengpeng Hou wrote:
> mwifiex event packets carry a four-byte event cause followed by the
> event body.  The USB and SDIO receive paths read the event cause and
> then copy adapter->event_body from skb->data + MWIFIEX_EVENT_HEADER_LEN,
> but pass the full skb->len as the copy length.  That makes the source
> range extend past the skb by the size of the event header.
> 
> Require the event header before reading the event cause, and copy only
> the bytes after the header into adapter->event_body.  Keep the existing
> per-path total event-size checks so this stays a narrow bounds fix.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/net/wireless/marvell/mwifiex/sdio.c | 10 ++++++++--
>  drivers/net/wireless/marvell/mwifiex/usb.c  |  5 +++--
>  2 files changed, 11 insertions(+), 4 deletions(-)
> 
> --- a/drivers/net/wireless/marvell/mwifiex/sdio.c
> +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
> @@ -1712,12 +1712,18 @@
>  	case MWIFIEX_TYPE_EVENT:
>  		mwifiex_dbg(adapter, EVENT,
>  			    "info: --- Rx: Event ---\n");
> +		if (skb->len < MWIFIEX_EVENT_HEADER_LEN) {
> +			mwifiex_dbg(adapter, ERROR,
> +				    "event packet too short: %u\n", skb->len);
> +			dev_kfree_skb_any(skb);
> +			return -1;
> +		}
>  		adapter->event_cause = get_unaligned_le32(skb->data);
>  
> -		if ((skb->len > 0) && (skb->len  < MAX_EVENT_SIZE))
> +		if (skb->len < MAX_EVENT_SIZE)

if (skb->len >= MWIFIEX_EVENT_HEADER_LEN && ... , instead ?


if we want to free the skb and return -1, we should probably not just do
it when skb->len < MWIFIEX_EVENT_HEADER_LEN, but also when the frame is
too big?

Francesco