Re: [PATCH v2] wifi: mwifiex: bound uAP association event IEs to the event buffer

[HE WEI（ギカク）]

> Where you able to test this? It looks ok, but you never know ...
>
> Reviewed-by: Francesco Dolcini <francesco.dolcini@xxxxxxxxxxx>

Thanks for the review and the tag. Honest answer: not on real
hardware. I don't have a mwifiex device, and the event is delivered by
the device firmware, so I could not drive EVENT_UAP_STA_ASSOC through
an actual association.

What I did verify: the driver builds on arm64 with W=1 and KASAN
enabled, no new warnings. And I checked the logic with an
AddressSanitizer userspace model of the exact arithmetic and the
cfg80211_find_ie() / for_each_element() walk. Without the patch it
faults with a heap-buffer-overflow READ one byte past the region that
stands in for the end of event_body. With this bound check applied to
the same model, the underflow and the over-claim that would run past
event_body[MAX_EVENT_SIZE] are rejected before the walk, so ASan is
clean.

A full in-kernel KASAN reproduction would need an emulated mwifiex
device (raw-gadget plus dummy_hcd for the USB case) to inject the
crafted event, which I have not set up. If anyone with the hardware
sees a uAP STA association, dumping event->len for a normal client
would also confirm that honest firmware stays well under the bound.

No change is requested, so I was not planning a respin; please tell me
if you would prefer one.

Francesco Dolcini <francesco@xxxxxxxxxx> 于2026年7月16日周四 01:28写道：
>
> On Wed, Jul 15, 2026 at 10:57:11PM +0900, HE WEI (ギカク) wrote:
> > mwifiex_process_uap_event() handles EVENT_UAP_STA_ASSOC by exposing the
> > (re)association request IEs that the firmware copies into the event:
> >
> >       sinfo->assoc_req_ies = &event->data[len];
> >       len = (u8 *)sinfo->assoc_req_ies - (u8 *)&event->frame_control;
> >       sinfo->assoc_req_ies_len = le16_to_cpu(event->len) - (u16)len;
> >
> > event->len is supplied by the device firmware and is never validated,
> > and the subtraction is unchecked.  assoc_req_ies points into
> ...
>
> >
> > Fixes: e568634ae7ac ("mwifiex: add AP event handling framework")
> > Signed-off-by: HE WEI (ギカク) <skyexpoc@xxxxxxxxx>
>
> Where you able to test this? It looks ok, but you never know ...
>
> Reviewed-by: Francesco Dolcini <francesco.dolcini@xxxxxxxxxxx>
>