[lvc-project] [PATCH 5.10/5.15] wifi: wfx: validate MIB read length before copying to caller

[Mikhail Dmitrichenko]

From: Aamir Ahmed <elb12345 at hotmail.co.uk>

commit ce67ebe9d8629776ce38e6995ae72fb903c828db upstream.

wfx_hif_read_mib() copies reply->length bytes from the firmware
response into the caller-provided buffer without checking that
reply->length does not exceed val_len. A firmware response with
a length field larger than expected overruns the caller buffer and
reads past the end of the reply allocation.

Replace the dead -ENOMEM check with an active validation that
reply->length fits within val_len before the memcpy.

Fixes: f95a29d40782 ("staging: wfx: add HIF commands helpers")
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345 at hotmail.co.uk>
Link: https://patch.msgid.link/AS8P251MB000155034FC391A2A54B9803C8BD2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Johannes Berg <johannes.berg at intel.com>
[mdmitrichenko: Apply the fix in drivers/staging/wfx/hif_tx.c,
 where the functions are named hif_read_mib() and get_mib_name().]
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko at astralinux.ru>
---
Backport fix for CVE-2026-98830.

 drivers/staging/wfx/hif_tx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/wfx/hif_tx.c b/drivers/staging/wfx/hif_tx.c
index 63b437261eb72..4ff109a582bf9 100644
--- a/drivers/staging/wfx/hif_tx.c
+++ b/drivers/staging/wfx/hif_tx.c
@@ -193,10 +193,12 @@ int hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,
 			 __func__);
 		ret = -EIO;
 	}
-	if (ret == -ENOMEM)
+	if (!ret && le16_to_cpu(reply->length) > val_len) {
 		dev_err(wdev->dev, "buffer is too small to receive %s (%zu < %d)\n",
 			get_mib_name(mib_id), val_len,
 			le16_to_cpu(reply->length));
+		ret = -EIO;
+	}
 	if (!ret)
 		memcpy(val, &reply->mib_data, le16_to_cpu(reply->length));
 	else
-- 
2.43.0