[PATCH wireless v2] wifi: wfx: validate MIB read length before copying to caller

[PATCH wireless v2] wifi: wfx: validate MIB read length before copying to caller

[Aamir Ahmed]

wfx_hif_read_mib() copies reply->length bytes from the firmware
response into the caller-provided buffer without checking that
reply->length does not exceed val_len. A firmware response with
a length field larger than expected overruns the caller buffer and
reads past the end of the reply allocation.

Replace the dead -ENOMEM check with an active validation that
reply->length fits within val_len before the memcpy.

Fixes: f95a29d40782 ("staging: wfx: add HIF commands helpers")
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
---
v2:
  - return -EIO rather than -EINVAL, for consistency with the
    confirmation-mismatch path above (Jérôme)
  - add the Assisted-by: LLM tag (Jérôme)
  - Cc LKML (Jérôme)
  - correct the Fixes: tag; wfx_hif_read_mib() came in with
    f95a29d40782, not the TX-frames commit v1 pointed at
  - say what is actually overrun; v1 called it a heap overflow, but
    the caller buffer is overrun and the reply allocation over-read
  - name the target tree in the subject
v1: https://lore.kernel.org/linux-wireless/AS8P251MB00014841C19595C74C545C80C8B22@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/

Compile-tested only; I have no WFxxx hardware.

 drivers/net/wireless/silabs/wfx/hif_tx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/silabs/wfx/hif_tx.c b/drivers/net/wireless/silabs/wfx/hif_tx.c
index 9f403d275cb1..9efb108bd877 100644
--- a/drivers/net/wireless/silabs/wfx/hif_tx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_tx.c
@@ -207,9 +207,11 @@ int wfx_hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, void *val, si
 		dev_warn(wdev->dev, "%s: confirmation mismatch request\n", __func__);
 		ret = -EIO;
 	}
-	if (ret == -ENOMEM)
+	if (!ret && le16_to_cpu(reply->length) > val_len) {
 		dev_err(wdev->dev, "buffer is too small to receive %s (%zu < %d)\n",
 			wfx_get_mib_name(mib_id), val_len, le16_to_cpu(reply->length));
+		ret = -EIO;
+	}
 	if (!ret)
 		memcpy(val, &reply->mib_data, le16_to_cpu(reply->length));
 	else

base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.55.0

Re: [PATCH wireless v2] wifi: wfx: validate MIB read length before copying to caller

[Jérôme Pouiller]

On Saturday 12 September 2026 06:47:55 Pacific Daylight Time Aamir Ahmed wrote:
> wfx_hif_read_mib() copies reply->length bytes from the firmware
> response into the caller-provided buffer without checking that
> reply->length does not exceed val_len. A firmware response with
> a length field larger than expected overruns the caller buffer and
> reads past the end of the reply allocation.
> 
> Replace the dead -ENOMEM check with an active validation that
> reply->length fits within val_len before the memcpy.
> 
> Fixes: f95a29d40782 ("staging: wfx: add HIF commands helpers")
> Assisted-by: LLM

Usually, you have to specify the name of the tool and the model used. eg.:

    Assisted-by: Codex:GPT-5

[...]
> diff --git a/drivers/net/wireless/silabs/wfx/hif_tx.c b/drivers/net/wireless/silabs/wfx/hif_tx.c
> index 9f403d275cb1..9efb108bd877 100644
> --- a/drivers/net/wireless/silabs/wfx/hif_tx.c
> +++ b/drivers/net/wireless/silabs/wfx/hif_tx.c
> @@ -207,9 +207,11 @@ int wfx_hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, void *val, si
>                 dev_warn(wdev->dev, "%s: confirmation mismatch request\n", __func__);
>                 ret = -EIO;
>         }
> -       if (ret == -ENOMEM)
> +       if (!ret && le16_to_cpu(reply->length) > val_len) {
>                 dev_err(wdev->dev, "buffer is too small to receive %s (%zu < %d)\n",
>                         wfx_get_mib_name(mib_id), val_len, le16_to_cpu(reply->length));
> +               ret = -EIO;
> +       }
>         if (!ret)
>                 memcpy(val, &reply->mib_data, le16_to_cpu(reply->length));
>         else
> 
> base-commit: df2908090cda368b01ff43709f51890076c56157

Was this line generated by git-send-email?

-- 
Jérôme Pouiller

Re: [PATCH wireless v2] wifi: wfx: validate MIB read length before copying to caller

[Aamir Ahmed]

On Wed, Sep 16, 2026 at 10:37:28AM -0700, Jérôme Pouiller wrote:
> Usually, you have to specify the name of the tool and the model used.

Sure, will add this extra info for v3. Thanks.

> Was this line generated by git-send-email?

It comes from git format-patch --base=, not send-email. The base is
df2908090cda ("Linux 7.3-rc2").

Kind Regards
Aamir A.