[PATCH] wifi: wfx: validate num_tx_confs against HIF message length
From: Aamir Ahmed <hidden>
Date: 2026-09-07 02:59:05
Subsystem:
silicon labs wireless drivers (for wfxxx series), the rest · Maintainers:
Jérôme Pouiller, Linus Torvalds
wfx_hif_multi_tx_confirm() trusts the device-supplied
num_tx_confs field without checking whether the HIF message
is large enough to contain that many entries. A malformed
or corrupted message with a large num_tx_confs value causes
out-of-bounds reads from the tx_conf_payload flexible array.
Validate that the HIF body is large enough for the fixed
header and the claimed number of confirmation entries before
iterating.
Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
Signed-off-by: Aamir Ahmed <redacted>
---
drivers/net/wireless/silabs/wfx/hif_rx.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/silabs/wfx/hif_rx.c b/drivers/net/wireless/silabs/wfx/hif_rx.c
index 64ca8acb8e4f..683fb67916c8 100644
--- a/drivers/net/wireless/silabs/wfx/hif_rx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_rx.c@@ -62,9 +62,15 @@ static int wfx_hif_multi_tx_confirm(struct wfx_dev *wdev, const struct wfx_hif_msg *hif, const void *buf) { const struct wfx_hif_cnf_multi_transmit *body = buf; + int hif_body_len = le16_to_cpu(hif->len) - sizeof(*hif); int i; - WARN(body->num_tx_confs <= 0, "corrupted message"); + if (hif_body_len < (int)sizeof(*body) || + body->num_tx_confs > (hif_body_len - sizeof(*body)) / + sizeof(body->tx_conf_payload[0])) { + dev_err(wdev->dev, "corrupted multi tx confirm\n"); + return -EINVAL; + } for (i = 0; i < body->num_tx_confs; i++) wfx_tx_confirm_cb(wdev, &body->tx_conf_payload[i]); return 0;
--
2.43.0