[PATCH wireless] wifi: wfx: validate num_tx_confs against message length

[PATCH wireless] wifi: wfx: validate num_tx_confs against message length

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

wfx_hif_multi_tx_confirm() iterates over the tx_conf_payload flexible
array based on body->num_tx_confs, but does not check that the message
is actually large enough to contain that many entries. Add a check
comparing num_tx_confs against the available message payload before
iterating.

Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/silabs/wfx/hif_rx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/silabs/wfx/hif_rx.c b/drivers/net/wireless/silabs/wfx/hif_rx.c
index 64ca8acb8e4f2..42417db66c128 100644
--- a/drivers/net/wireless/silabs/wfx/hif_rx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_rx.c
@@ -62,8 +62,17 @@ static int wfx_hif_multi_tx_confirm(struct wfx_dev *wdev,
 				    const struct wfx_hif_msg *hif, const void *buf)
 {
 	const struct wfx_hif_cnf_multi_transmit *body = buf;
+	size_t needed;
 	int i;
 
+	needed = sizeof(*body) +
+		 body->num_tx_confs * sizeof(body->tx_conf_payload[0]);
+	if (le16_to_cpu(hif->len) < sizeof(*hif) + needed) {
+		dev_warn(wdev->dev, "invalid num_tx_confs %d for msg length %d\n",
+			 body->num_tx_confs, le16_to_cpu(hif->len));
+		return -EINVAL;
+	}
+
 	WARN(body->num_tx_confs <= 0, "corrupted message");
 	for (i = 0; i < body->num_tx_confs; i++)
 		wfx_tx_confirm_cb(wdev, &body->tx_conf_payload[i]);
-- 
2.47.3

Re: [PATCH wireless] wifi: wfx: validate num_tx_confs against message length

[Jérôme Pouiller]

On Wednesday 4 November 2026 00:26:50 Central European Standard Time Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> wfx_hif_multi_tx_confirm() iterates over the tx_conf_payload flexible
> array based on body->num_tx_confs, but does not check that the message
> is actually large enough to contain that many entries. Add a check
> comparing num_tx_confs against the available message payload before
> iterating.
> 
> Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/net/wireless/silabs/wfx/hif_rx.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/net/wireless/silabs/wfx/hif_rx.c b/drivers/net/wireless/silabs/wfx/hif_rx.c
> index 64ca8acb8e4f2..42417db66c128 100644
> --- a/drivers/net/wireless/silabs/wfx/hif_rx.c
> +++ b/drivers/net/wireless/silabs/wfx/hif_rx.c
> @@ -62,8 +62,17 @@ static int wfx_hif_multi_tx_confirm(struct wfx_dev *wdev,
>                                     const struct wfx_hif_msg *hif, const void *buf)
>  {
>         const struct wfx_hif_cnf_multi_transmit *body = buf;
> +       size_t needed;
>         int i;
> 
> +       needed = sizeof(*body) +
> +                body->num_tx_confs * sizeof(body->tx_conf_payload[0]);
> +       if (le16_to_cpu(hif->len) < sizeof(*hif) + needed) {
> +               dev_warn(wdev->dev, "invalid num_tx_confs %d for msg length %d\n",
> +                        body->num_tx_confs, le16_to_cpu(hif->len));
> +               return -EINVAL;
> +       }
> +
[...]

body->num_tx_confs is already used in rx_helper(). So, the
error detection happens to late.

-- 
Jérôme Pouiller