Re: [PATCH] wifi: mwifiex: bound uAP association event IEs to the event buffer

[skyexpoc]

> Should we consider the firmware trust-worthy or should we validate

> everything we receive from it? Is there some agreement on this topic

> in general?

For mwifiex there's a concrete reason not to trust it: besides the

SDIO/PCIe parts, mwifiex also drives USB dongles (8797/8801/8997), so the

"firmware" can sit on a hot-pluggable, potentially attacker-supplied

device. A malformed event from such a device is the same threat model as

any other malicious USB peripheral, not just a hypothetical firmware bug.

There is also precedent inside mwifiex itself: commit 119585281617

("wifi: mwifiex: Fix OOB and integer underflow when rx packets") already

added exactly these bounds checks to the receive-data path. This patch is

the same class of fix for the uAP event path, which that commit did not

cover.

So I'd say it's consistent with how the driver already treats

firmware-reported lengths and agreed, worth fixing.

Thanks,

HE WEI（ギカク）

On Friday, Jul 10, 2026 at 4:41 PM, Johannes Berg <johannes@xxxxxxxxxxxxxxxx> wrote:

On Fri, 2026-07-10 at 09:21 +0200, Francesco Dolcini wrote:

I think we received a few patches that are validating the data received
from the firmware (including this one).

I did not review any of them yet, what is your opinion on those?

Should we consider the firmware trust-worth or should we validate
everything we receive from it? Is there some agreement on this topic in
general?

I don't really know fully "in general", but I/we generally treat these
as issues. I'm not going to worry too much about them, but I think we
should fix them.

johannes

Attachment: signature.asc
Description: PGP signature