Re: [PATCH v3 1/6] wifi: mwifiex: fix OOB write from firmware queue_index in WMM status response

[Brian Norris <briannorris@chromium.org>]

Hi Tristan,

I haven't gotten through all of these yet, but so far, they seem good
aside from some cosmetic things.

Comments inline.

On Tue, Apr 21, 2026 at 01:49:33PM +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> The firmware-controlled queue_index (u8) from the WMM queue status TLV
> is used to index the 4-entry ac_status[] array without validation. An
> out-of-range value causes out-of-bounds writes of three firmware-
> controlled bytes into adjacent struct fields.
> 
> Add a bounds check before using queue_index as an array index.
> 
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
> Changes in v3:
>   - Regenerated from wireless-next with proper git format-patch to
>     produce valid index hashes (v2 had post-processed index lines).
> 
> Changes in v2:
>   - No code changes from v1.
> 
>  drivers/net/wireless/marvell/mwifiex/wmm.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c
> index 841505e83c7fd..27e6dedcca2e8 100644
> --- a/drivers/net/wireless/marvell/mwifiex/wmm.c
> +++ b/drivers/net/wireless/marvell/mwifiex/wmm.c
> @@ -943,6 +943,11 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
>  				    tlv_wmm_qstatus->flow_required,
>  				    tlv_wmm_qstatus->disabled);
>  
> +

Checkpatch complains about these double blank lines. Remove one.

> +			if (tlv_wmm_qstatus->queue_index >=
> +			    IEEE80211_NUM_ACS) {

Unnecessary line break.

You could also replace IEEE80211_NUM_ACS with
ARRAY_SIZE(priv->wmm.ac_status) for clarity.

> +				break;
> +			}

Might as well drop the braces, for a simple 1-liner conditional.

Also, please add a blank line after.

Thanks,
Brian

>  			ac_status = &priv->wmm.ac_status[tlv_wmm_qstatus->
>  							 queue_index];
>  			ac_status->disabled = tlv_wmm_qstatus->disabled;
> -- 
> 2.47.3
>