Re: [PATCH] wifi: wfx: validate num_tx_confs against HIF message length

wfx_hif_multi_tx_confirm() trusts the device-supplied
num_tx_confs field without checking whether the HIF message
is large enough to contain that many entries. A malformed
or corrupted message with a large num_tx_confs value causes
out-of-bounds reads from the tx_conf_payload flexible array.

Validate that the HIF body is large enough for the fixed
header and the claimed number of confirmation entries before
iterating.

Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
Signed-off-by: Aamir Ahmed <redacted>
---
 drivers/net/wireless/silabs/wfx/hif_rx.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/silabs/wfx/hif_rx.c b/drivers/net/wireless/silabs/wfx/hif_rx.c
index 64ca8acb8e4f..683fb67916c8 100644
--- a/drivers/net/wireless/silabs/wfx/hif_rx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_rx.c

@@ -62,9 +62,15 @@ static int wfx_hif_multi_tx_confirm(struct wfx_dev *wdev,
                                    const struct wfx_hif_msg *hif, const void *buf)
 {
        const struct wfx_hif_cnf_multi_transmit *body = buf;
+       int hif_body_len = le16_to_cpu(hif->len) - sizeof(*hif);
        int i;

-       WARN(body->num_tx_confs <= 0, "corrupted message");
+       if (hif_body_len < (int)sizeof(*body) ||
+           body->num_tx_confs > (hif_body_len - sizeof(*body)) /
+                                sizeof(body->tx_conf_payload[0])) {
+               dev_err(wdev->dev, "corrupted multi tx confirm\n");
+               return -EINVAL;
+       }