Re: [PATCH v2 1/2] wifi: p54: validate curve data length in the calibration curve converters

[Christian Lamparter]

On 9/6/26 1:43 PM, Shengzhuo Wei wrote:
> On 2026-09-06 11:31, Christian Lamparter wrote:
> > > diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
> > > index 95580921d933..0dc848d77c5e 100644
> > > --- a/drivers/net/wireless/intersil/p54/eeprom.c
> > > +++ b/drivers/net/wireless/intersil/p54/eeprom.c
> > > @@ -414,17 +414,22 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
> > >    }
> > >    static int p54_convert_rev0(struct ieee80211_hw *dev,
> > > -			    struct pda_pa_curve_data *curve_data)
> > > +			    struct pda_pa_curve_data *curve_data, size_t len)
> > >    {
> > >    	struct p54_common *priv = dev->priv;
> > >    	struct p54_pa_curve_data_sample *dst;
> > >    	struct pda_pa_curve_data_sample_rev0 *src;
> > > +	size_t needed = curve_data->channels *
> > > +		(sizeof(*src) * curve_data->points_per_channel + 2);
> > >    	size_t cd_len = sizeof(*curve_data) +
> > >    		(curve_data->points_per_channel*sizeof(*dst) + 2) *
> > >    		 curve_data->channels;
> > >    	unsigned int i, j;
> > >    	void *source, *target;
> > > +	if (len < sizeof(*curve_data) + needed)
> > > +		return -EINVAL;
> > > +
> >
> > Hmm, Puh. Interessting. Several things. But yeah, this should work.
> >
> > Acked-by: Christian Lamparter <chunkeey@xxxxxxxxx>
>
> Hi Christian,
>
> Thanks for the review and the Ack.
>
> > Still I have some questions: Did you write/touch any of this yourself?
> > Or is this patch straight from the model?
>
> AI found the bug. I wrote the fix myself and used AI to review it
> afterwards.
>   
> > It's because I can grok (heh) why "needed" ended up as a separate variable next to cd_len.
> > But why was the sizeof(*curve_data) not included there too? It's only used once in the
> > if check so and this sounds like the "needed" needed some extra? Maybe because it was
> > already checked?
>
> I kept sizeof(*curve_data) separate because I was thinking of needed
> as the input data size without the header. But since it is only used
> in that check, adding the header there too would be simpler.
>
> Would you like me to send a v3 that makes just this change in both
> converters?

Well... I think Johannes already added v2 two days ago to wireless + wireless-next.
<https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=ce858fa6b8a214dee5adb82358885fa024cdd887>

So: 🤷. I don't think you need to bother with making/sending a v3.

Cheers,
Christian