[PATCH v4] wifi: mwifiex: validate event lengths before copying bodies

[PATCH v4] wifi: mwifiex: validate event lengths before copying bodies

[Pengpeng Hou]

mwifiex event packets contain a four-byte event cause followed by the
event body. The USB and SDIO paths copy from data after that header using
the full packet length, so the source range extends four bytes beyond the
skb. The SDIO path also reads the event cause before validating the
packet and publishes oversized events without a copied body.

Reject SDIO events that are shorter than the header or whose body exceeds
the event buffer. Discard them through the same free-and-break contract
used for unknown upload types. Retain USB's existing error path, apply the
same body-length upper bound there, and copy only the bytes after the event
header in both paths.

Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v3: https://lore.kernel.org/all/20260723103510.3-mwifiex-event-v3-pengpeng@iscas.ac.cn/
- compute the upper bound from the event body length, as requested by
  Jeff Chen
- apply the same body-length bound to USB and allow a full MAX_EVENT_SIZE
  body in both paths
- add Francesco Dolcini's Reviewed-by
- rebase onto the current tree

 drivers/net/wireless/marvell/mwifiex/sdio.c | 15 +++++++++++----
 drivers/net/wireless/marvell/mwifiex/usb.c  |  6 ++++--
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index f039d6f19183..ccaf515d5597 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -1712,12 +1712,19 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
 	case MWIFIEX_TYPE_EVENT:
 		mwifiex_dbg(adapter, EVENT,
 			    "info: --- Rx: Event ---\n");
+		if (skb->len < MWIFIEX_EVENT_HEADER_LEN ||
+		    skb->len - MWIFIEX_EVENT_HEADER_LEN > MAX_EVENT_SIZE) {
+			mwifiex_dbg(adapter, ERROR,
+				    "EVENT: invalid skb->len %u\n", skb->len);
+			dev_kfree_skb_any(skb);
+			break;
+		}
+
 		adapter->event_cause = get_unaligned_le32(skb->data);
 
-		if ((skb->len > 0) && (skb->len  < MAX_EVENT_SIZE))
-			memcpy(adapter->event_body,
-			       skb->data + MWIFIEX_EVENT_HEADER_LEN,
-			       skb->len);
+		memcpy(adapter->event_body,
+		       skb->data + MWIFIEX_EVENT_HEADER_LEN,
+		       skb->len - MWIFIEX_EVENT_HEADER_LEN);
 
 		/* event cause has been saved to adapter->event_cause */
 		adapter->event_received = true;
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index f4b94a1054f6..7f3d0f9f4fd6 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -102,7 +102,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
 			mwifiex_dbg(adapter, EVENT,
 				    "event_cause %#x\n", adapter->event_cause);
 
-			if (skb->len > MAX_EVENT_SIZE) {
+			if (skb->len - MWIFIEX_EVENT_HEADER_LEN >
+			    MAX_EVENT_SIZE) {
 				mwifiex_dbg(adapter, ERROR,
 					    "EVENT: event body too large\n");
 				ret = -1;
@@ -110,7 +111,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
 			}
 
 			memcpy(adapter->event_body, skb->data +
-			       MWIFIEX_EVENT_HEADER_LEN, skb->len);
+			       MWIFIEX_EVENT_HEADER_LEN,
+			       skb->len - MWIFIEX_EVENT_HEADER_LEN);
 
 			adapter->event_received = true;
 			adapter->event_skb = skb;
-- 
2.50.1

Re: [PATCH v4] wifi: mwifiex: validate event lengths before copying bodies

[Jeff Chen]

On Fri, Jul 31, 2026 at 10:20:02 PM +0800, Pengpeng Hou wrote:
> mwifiex event packets contain a four-byte event cause followed by the
> event body. The USB and SDIO paths copy from data after that header using
> the full packet length, so the source range extends four bytes beyond the
> skb. The SDIO path also reads the event cause before validating the
> packet and publishes oversized events without a copied body.
> 
> Reject SDIO events that are shorter than the header or whose body exceeds
> the event buffer. Discard them through the same free-and-break contract
> used for unknown upload types. Retain USB's existing error path, apply the
> same body-length upper bound there, and copy only the bytes after the event
> header in both paths.
> 
> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---

Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>