Re: [PATCH v4] wifi: mwifiex: validate HT/VHT capability and operation IE lengths

[Johannes Berg]

On Fri, 2026-08-14 at 15:47 +0200, Doruk Tan Ozturk wrote:
> 
> Assisted-by: 0sec:multi-model

If you're going to use LLMs anyway, how about you ask another instance
to review your patches? :-)

>  - Use sizeof(*ptr) for the length checks instead of naming the struct
>    type, so a check cannot drift from the type the pointer is
>    dereferenced as. bcn_ht_cap/bcn_ht_oper/bcn_vht_cap/bcn_vht_oper/
>    oper_mode are all typed pointers.

> +++ b/drivers/net/wireless/marvell/mwifiex/util.c
> @@ -721,7 +721,7 @@ mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
>  
>  	ht_cap_ie = (void *)cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies,
>  					     ies_len);
> -	if (ht_cap_ie) {
> +	if (ht_cap_ie && ht_cap_ie->len >= sizeof(struct ieee80211_ht_cap)) {

missed that, ht_cap is in scope so can be sizeof(*ht_cap).

johannes