Re: [PATCH wireless-next v2] wifi: nxpwifi: validate variable IE lengths in beacon parser

[Aamir Ahmed]

On Mon, Sep 14, 2026 at 04:19:10PM +0800, Jeff Chen wrote:
> On Sat, Sep 12, 2026 at 05:20:31 PM +0100, Aamir Ahmed wrote:
> >  		case WLAN_EID_OPMODE_NOTIF:
> > +			if (total_ie_len < sizeof(*bss_entry->oper_mode))
> > +				return -EINVAL;
> >  			bss_entry->oper_mode = (void *)current_ptr;
> >  			bss_entry->oper_mode_offset =
> >  				(u16)(current_ptr - bss_entry->beacon_buf);
>
> Any reason to use total_ie_len here instead of element_len?
> Since we only access oper_mode->oper_mode later, would
> 	element_len < sizeof(bss_entry->oper_mode->oper_mode)
> also work here?

Yes, I used total_ie_len to match the FH, DS and CF parameter set
cases, which also map the struct from the element header and check
total_ie_len against the whole struct.

> The current check looks fine to me.
>
> Reviewed-by: Jeff Chen <jeff.chen_1@xxxxxxx>

Thanks for the review.

Kind Regards

Aamir A.