Re: [PATCH v4] wifi: mwifiex: validate event lengths before copying bodies

[Johannes Berg]

On Fri, 2026-07-31 at 22:20 +0800, Pengpeng Hou wrote:
> 
> +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
> @@ -1712,12 +1712,19 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
>  	case MWIFIEX_TYPE_EVENT:
>  		mwifiex_dbg(adapter, EVENT,
>  			    "info: --- Rx: Event ---\n");
> +		if (skb->len < MWIFIEX_EVENT_HEADER_LEN ||
> +		    skb->len - MWIFIEX_EVENT_HEADER_LEN > MAX_EVENT_SIZE) {
> +			mwifiex_dbg(adapter, ERROR,
> +				    "EVENT: invalid skb->len %u\n", skb->len);
> +			dev_kfree_skb_any(skb);
> +			break;
> +		}
> +
>  		adapter->event_cause = get_unaligned_le32(skb->data);

Are you all sure this is right? PCIe still delivers the event w/o the
body if it's too big?

johannes