The service-ready parser counts DMA ring capability TLVs and later indexes the firmware array using the full structure stride. It does not validate that each TLV payload covers that structure, so a short element can cause out-of-bounds reads. Add a minimum-length policy for DMA ring capability TLVs. Fixes: bd6478559e27 ("ath11k: Add direct buffer ring support") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath11k/wmi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c index 8a73318704f3..c5c667828530 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -167,6 +167,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = { .min_len = sizeof(struct wmi_dma_buf_release_meta_data) - TLV_HDR_SIZE }, [WMI_TAG_HW_MODE_CAPABILITIES] = { .min_len = sizeof(struct wmi_hw_mode_capabilities) - TLV_HDR_SIZE }, + [WMI_TAG_DMA_RING_CAPABILITIES] = { + .min_len = sizeof(struct wmi_dma_ring_capabilities) - TLV_HDR_SIZE }, }; #define PRIMAP(_hw_mode_) \ -- 2.34.1