Re: [PATCH wireless] wifi: wfx: validate num_tx_confs against message length

[Jérôme Pouiller]

On Wednesday 4 November 2026 00:26:50 Central European Standard Time Tristan Madani wrote:
> From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> 
> wfx_hif_multi_tx_confirm() iterates over the tx_conf_payload flexible
> array based on body->num_tx_confs, but does not check that the message
> is actually large enough to contain that many entries. Add a check
> comparing num_tx_confs against the available message payload before
> iterating.
> 
> Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/net/wireless/silabs/wfx/hif_rx.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/net/wireless/silabs/wfx/hif_rx.c b/drivers/net/wireless/silabs/wfx/hif_rx.c
> index 64ca8acb8e4f2..42417db66c128 100644
> --- a/drivers/net/wireless/silabs/wfx/hif_rx.c
> +++ b/drivers/net/wireless/silabs/wfx/hif_rx.c
> @@ -62,8 +62,17 @@ static int wfx_hif_multi_tx_confirm(struct wfx_dev *wdev,
>                                     const struct wfx_hif_msg *hif, const void *buf)
>  {
>         const struct wfx_hif_cnf_multi_transmit *body = buf;
> +       size_t needed;
>         int i;
> 
> +       needed = sizeof(*body) +
> +                body->num_tx_confs * sizeof(body->tx_conf_payload[0]);
> +       if (le16_to_cpu(hif->len) < sizeof(*hif) + needed) {
> +               dev_warn(wdev->dev, "invalid num_tx_confs %d for msg length %d\n",
> +                        body->num_tx_confs, le16_to_cpu(hif->len));
> +               return -EINVAL;
> +       }
> +
[...]

body->num_tx_confs is already used in rx_helper(). So, the
error detection happens to late.

-- 
Jérôme Pouiller