Re: [PATCH v4] wifi: mwifiex: validate event lengths before copying bodies

[Pengpeng Hou]

Hi Johannes,

Yes. PCIe sets event_received even when its size condition skips the copy
into event_body. USB and SDIO rejection alone would leave inconsistent
handling and could leave PCIe consumers using an unchanged event body.

The PCIe length also includes the transport header. A revision needs to
validate that extent before trimming/pulling the skb, copy only the body
after both headers, and return a rejected event buffer to its DMA ring
without publishing the event. Dropping the buffer without that ring
completion is not sufficient.

I will hold v4 until that common rejection policy and PCIe buffer-return
path are covered together, rather than resend the USB/SDIO-only change.

Thanks,
Pengpeng