RE: [PATCH rtw-next v3 1/2] wifi: rtw88: drop C2H packets shorter than the C2H header

[Ping-Ke Shih <pkshih@realtek.com>]

Huihui Huang <hhhuang@smu.edu.sg> wrote:
> rtw_fw_c2h_cmd_rx_irqsafe() and rtw_fw_c2h_cmd_handle() compute the C2H
> payload length as
> 
>         len = skb->len - pkt_offset - 2;
> 
> where len is a u8, without checking that the skb holds the 2-byte C2H
> header (id and seq).
> 
> If the header is incomplete, the C2H payload length underflows: zero
> bytes after pkt_offset produce len = 254, and one byte produces
> len = 255. With zero bytes, reading c2h->id also accesses data beyond
> skb->len. The wrapped len defeats the minimum-length checks in
> rtw_fw_ra_report_handle() and rtw_coex_wl_fwdbginfo_notify(), which then
> read their fixed-size reports beyond the valid packet data.
> 
> skb->len is pkt_offset plus pkt_len from the RX descriptor, and
> rtw_rx_query_rx_desc() returns for C2H packets before its
> "pkt_len <= FCS_LEN" check, so a short C2H packet is not rejected there.
> 
> Drop C2H packets that are too short to hold the C2H header. Since
> rtw_fw_c2h_cmd_handle() only sees skbs queued by
> rtw_fw_c2h_cmd_rx_irqsafe(), this covers both computations.

No need much commit message. Just say that you are validating C2H packet
length before reading.

> 
> Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM

This tag is no long necessary. 

> Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
> Reviewed-by: Luka Gejak <luka.gejak@linux.dev>

As I requested to reword commit message, you can still take Luka's reviewed-by.