[PATCH wireless] wifi: wfx: validate num_tx_confs against message length

[PATCH wireless] wifi: wfx: validate num_tx_confs against message length

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

wfx_hif_multi_tx_confirm() iterates over the tx_conf_payload flexible
array based on body->num_tx_confs, but does not check that the message
is actually large enough to contain that many entries. Add a check
comparing num_tx_confs against the available message payload before
iterating.

Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/silabs/wfx/hif_rx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/silabs/wfx/hif_rx.c b/drivers/net/wireless/silabs/wfx/hif_rx.c
index 64ca8acb8e4f2..42417db66c128 100644
--- a/drivers/net/wireless/silabs/wfx/hif_rx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_rx.c
@@ -62,8 +62,17 @@ static int wfx_hif_multi_tx_confirm(struct wfx_dev *wdev,
 				    const struct wfx_hif_msg *hif, const void *buf)
 {
 	const struct wfx_hif_cnf_multi_transmit *body = buf;
+	size_t needed;
 	int i;
 
+	needed = sizeof(*body) +
+		 body->num_tx_confs * sizeof(body->tx_conf_payload[0]);
+	if (le16_to_cpu(hif->len) < sizeof(*hif) + needed) {
+		dev_warn(wdev->dev, "invalid num_tx_confs %d for msg length %d\n",
+			 body->num_tx_confs, le16_to_cpu(hif->len));
+		return -EINVAL;
+	}
+
 	WARN(body->num_tx_confs <= 0, "corrupted message");
 	for (i = 0; i < body->num_tx_confs; i++)
 		wfx_tx_confirm_cb(wdev, &body->tx_conf_payload[i]);
-- 
2.47.3