From: Jiale Yao Firmware reports the number of PHYs separately from the array of extended regulatory capabilities. The TLV parser rejects excess array entries, but accepts an array with fewer entries than the reported PHY count. The subsequent loop uses the reported count and reads beyond the supplied array. Reject mismatched counts before indexing the capability array. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath12k/wmi.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c index d5160af60e00..66e39672dcda 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -4824,6 +4824,13 @@ static int ath12k_wmi_ext_hal_reg_caps(struct ath12k_base *soc, return ret; } + if (svc_rdy_ext->n_ext_hal_reg_caps != svc_rdy_ext->arg.num_phy) { + ath12k_warn(soc, "invalid number of reg caps %u, expected %u\n", + svc_rdy_ext->n_ext_hal_reg_caps, + svc_rdy_ext->arg.num_phy); + return -EINVAL; + } + for (i = 0; i < svc_rdy_ext->arg.num_phy; i++) { ret = ath12k_pull_reg_cap_svc_rdy_ext(wmi_handle, svc_rdy_ext->soc_hal_reg_caps, -- 2.34.1