Re: [PATCH v3 4/6] wifi: mwifiex: fix OOB read in scan response from mismatched TLV data sizes

[Brian Norris <briannorris@chromium.org>]

On Tue, Apr 21, 2026 at 01:49:36PM +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> The TSF and ChanBand TLV arrays are indexed by the firmware-controlled
> number_of_sets without cross-checking against the TLV header length
> fields. When number_of_sets exceeds the TLV data, the loop reads past
> the TLV data into adjacent command response memory.
> 
> Stop using the TLV data once the index exceeds its reported length.
> 
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
> Changes in v3:
>   - Regenerated from wireless-next with proper git format-patch to
>     produce valid index hashes (v2 had post-processed index lines).
> 
> Changes in v2:
>   - No code changes from v1.
> 
>  drivers/net/wireless/marvell/mwifiex/scan.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)

My brain cries a little every time I have to read and trust this sort of
arithmetic in C.

Acked-by: Brian Norris <briannorris@chromium.org>