Re: [PATCH v2] wifi: mwifiex: bound uAP association event IEs to the event buffer

[Francesco Dolcini]

On Wed, Jul 15, 2026 at 10:57:11PM +0900, HE WEI (ギカク) wrote:
> mwifiex_process_uap_event() handles EVENT_UAP_STA_ASSOC by exposing the
> (re)association request IEs that the firmware copies into the event:
> 
> 	sinfo->assoc_req_ies = &event->data[len];
> 	len = (u8 *)sinfo->assoc_req_ies - (u8 *)&event->frame_control;
> 	sinfo->assoc_req_ies_len = le16_to_cpu(event->len) - (u16)len;
> 
> event->len is supplied by the device firmware and is never validated,
> and the subtraction is unchecked.  assoc_req_ies points into
...

> 
> Fixes: e568634ae7ac ("mwifiex: add AP event handling framework")
> Signed-off-by: HE WEI (ギカク) <skyexpoc@xxxxxxxxx>

Where you able to test this? It looks ok, but you never know ...

Reviewed-by: Francesco Dolcini <francesco.dolcini@xxxxxxxxxxx>