Re: [PATCH v2 1/2] wifi: p54: validate curve data length in the calibration curve converters

[Christian Lamparter <chunkeey@gmail.com>]

On 9/6/26 1:43 PM, Shengzhuo Wei wrote:
> On 2026-09-06 11:31, Christian Lamparter wrote:
>>> diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
>>> index 95580921d933..0dc848d77c5e 100644
>>> --- a/drivers/net/wireless/intersil/p54/eeprom.c
>>> +++ b/drivers/net/wireless/intersil/p54/eeprom.c
>>> @@ -414,17 +414,22 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
>>>    }
>>>    static int p54_convert_rev0(struct ieee80211_hw *dev,
>>> -			    struct pda_pa_curve_data *curve_data)
>>> +			    struct pda_pa_curve_data *curve_data, size_t len)
>>>    {
>>>    	struct p54_common *priv = dev->priv;
>>>    	struct p54_pa_curve_data_sample *dst;
>>>    	struct pda_pa_curve_data_sample_rev0 *src;
>>> +	size_t needed = curve_data->channels *
>>> +		(sizeof(*src) * curve_data->points_per_channel + 2);
>>>    	size_t cd_len = sizeof(*curve_data) +
>>>    		(curve_data->points_per_channel*sizeof(*dst) + 2) *
>>>    		 curve_data->channels;
>>>    	unsigned int i, j;
>>>    	void *source, *target;
>>> +	if (len < sizeof(*curve_data) + needed)
>>> +		return -EINVAL;
>>> +
>>
>> Hmm, Puh. Interessting. Several things. But yeah, this should work.
>>
>> Acked-by: Christian Lamparter <chunkeey@gmail.com>
> 
> Hi Christian,
> 
> Thanks for the review and the Ack.
> 
>> Still I have some questions: Did you write/touch any of this yourself?
>> Or is this patch straight from the model?
> 
> AI found the bug. I wrote the fix myself and used AI to review it
> afterwards.
>   
>> It's because I can grok (heh) why "needed" ended up as a separate variable next to cd_len.
>> But why was the sizeof(*curve_data) not included there too? It's only used once in the
>> if check so and this sounds like the "needed" needed some extra? Maybe because it was
>> already checked?
> 
> I kept sizeof(*curve_data) separate because I was thinking of needed
> as the input data size without the header. But since it is only used
> in that check, adding the header there too would be simpler.
> 
> Would you like me to send a v3 that makes just this change in both
> converters?

Well... I think Johannes already added v2 two days ago to wireless + wireless-next.
<https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=ce858fa6b8a214dee5adb82358885fa024cdd887>

So: 🤷. I don't think you need to bother with making/sending a v3.

Cheers,
Christian