[PATCH] wifi: wfx: validate MIB read length before copying to caller

[PATCH] wifi: wfx: validate MIB read length before copying to caller

[Aamir Ahmed]

wfx_hif_read_mib() copies reply->length bytes from the firmware
response into the caller-provided buffer without checking that
reply->length does not exceed val_len. A firmware response with
a length field larger than expected causes a heap buffer overflow
when writing to the caller buffer.

Replace the dead -ENOMEM check with an active validation that
reply->length fits within val_len before the memcpy.

Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
---
 drivers/net/wireless/silabs/wfx/hif_tx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/silabs/wfx/hif_tx.c b/drivers/net/wireless/silabs/wfx/hif_tx.c
index 9f403d275cb1..a6bc1c522e3c 100644
--- a/drivers/net/wireless/silabs/wfx/hif_tx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_tx.c
@@ -207,9 +207,11 @@ int wfx_hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, void *val, si
 		dev_warn(wdev->dev, "%s: confirmation mismatch request\n", __func__);
 		ret = -EIO;
 	}
-	if (ret == -ENOMEM)
+	if (!ret && le16_to_cpu(reply->length) > val_len) {
 		dev_err(wdev->dev, "buffer is too small to receive %s (%zu < %d)\n",
 			wfx_get_mib_name(mib_id), val_len, le16_to_cpu(reply->length));
+		ret = -EINVAL;
+	}
 	if (!ret)
 		memcpy(val, &reply->mib_data, le16_to_cpu(reply->length));
 	else
-- 
2.43.0

Re: [PATCH] wifi: wfx: validate MIB read length before copying to caller

[Jérôme Pouiller]

On Monday 7 September 2026 05:17:57 Central European Summer Time Aamir Ahmed wrote:
> wfx_hif_read_mib() copies reply->length bytes from the firmware
> response into the caller-provided buffer without checking that
> reply->length does not exceed val_len. A firmware response with
> a length field larger than expected causes a heap buffer overflow
> when writing to the caller buffer.
> 
> Replace the dead -ENOMEM check with an active validation that
> reply->length fits within val_len before the memcpy.
> 
> Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
> Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>

Note you should add LKML in Cc: of all your patches (see [1]).

This kind of bug are typically spotted by AI agents. If you have used
a such tool to discover/fix/review the issue, you are supposed to
comply with [2].

[1]: scripts/get_maintainer.pl
[2]: Documentation/process/generated-content.rst  

> ---
>  drivers/net/wireless/silabs/wfx/hif_tx.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/silabs/wfx/hif_tx.c b/drivers/net/wireless/silabs/wfx/hif_tx.c
> index 9f403d275cb1..a6bc1c522e3c 100644
> --- a/drivers/net/wireless/silabs/wfx/hif_tx.c
> +++ b/drivers/net/wireless/silabs/wfx/hif_tx.c
> @@ -207,9 +207,11 @@ int wfx_hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, void *val, si
>                 dev_warn(wdev->dev, "%s: confirmation mismatch request\n", __func__);
>                 ret = -EIO;
>         }
> -       if (ret == -ENOMEM)
> +       if (!ret && le16_to_cpu(reply->length) > val_len) {
>                 dev_err(wdev->dev, "buffer is too small to receive %s (%zu < %d)\n",
>                         wfx_get_mib_name(mib_id), val_len, le16_to_cpu(reply->length));
> +               ret = -EINVAL;

I believe -EIO would be more consistent. Otherwise, LGTM.


-- 
Jérôme Pouiller

Re: [PATCH] wifi: wfx: validate MIB read length before copying to caller

[Aamir Ahmed]

On Mon, Sep 07, 2026 at 05:36:20PM +0200, Jerome Pouiller wrote:
> Note you should add LKML in Cc: of all your patches (see [1]).

Will do, apologies for missing it.

> This kind of bug are typically spotted by AI agents. If you have used
> a such tool to discover/fix/review the issue, you are supposed to
> comply with [2].

Yes, an LLM-based tool was used and I missed the disclosure, sorry.
v2 will carry the Assisted-by: LLM tag.

> I believe -EIO would be more consistent. Otherwise, LGTM.

Ok, v2 will use -EIO.

While respinning I noticed the Fixes: tag points at the wrong commit -
9bca45f3d692 added the TX path, but wfx_hif_read_mib() came in with
f95a29d40782 ("staging: wfx: add HIF commands helpers"), so v2 will
reference that instead.

Kind Regards

Aamir A.