[PATCH v2 0/6] wifi: mwifiex: fix OOB reads and writes from firmware response fields

Tristan Madani posted 6 patches 2 months ago
[PATCH v2 0/6] wifi: mwifiex: fix OOB reads and writes from firmware response fields
Posted by Tristan Madani 2 months ago
From: Tristan Madani <tristan@talencesecurity.com>

Hi Brian,

Note: this is a v2 resubmission. The original was sent via Gmail which
caused HTML rendering issues. This version uses git send-email for
proper plain-text formatting.

Six issues in mwifiex where firmware-controlled fields are used as array
indices or loop bounds without validation. Two are OOB writes, four are
OOB reads:

Proposed fixes in the following patches.

Thanks,
Tristan
Re: [PATCH v2 0/6] wifi: mwifiex: fix OOB reads and writes from firmware response fields
Posted by Brian Norris 2 months ago
On Wed, Apr 15, 2026 at 10:23:21PM +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> Hi Brian,
> 
> Note: this is a v2 resubmission. The original was sent via Gmail which
> caused HTML rendering issues. This version uses git send-email for
> proper plain-text formatting.

You also sent it privately / directly to me, and I don't think you even
sent the whole thing. You've fixed some of that now, thanks.

> Six issues in mwifiex where firmware-controlled fields are used as array
> indices or loop bounds without validation. Two are OOB writes, four are
> OOB reads:
> 
> Proposed fixes in the following patches.

Several of these don't actually apply to wireless/for-next correctly, so
I can't actually review them. On at least one, I think you seem to have
stripped a line or two somehow.

Please confirm you can apply your series to
git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git
for-next with 'git am', and then resend.

Brian