The service-ready parser indexes hardware mode capability TLVs using the full structure stride and reads their PHY maps without validating the firmware-declared payload length. A short TLV can therefore cause an out-of-bounds read. Add a minimum-length policy for hardware mode capability TLVs. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath11k/wmi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c index ef2c2c300854..047ae8f5bb60 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -167,6 +167,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = { .min_len = sizeof(struct wmi_dma_buf_release_entry) - TLV_HDR_SIZE }, [WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = { .min_len = sizeof(struct wmi_dma_buf_release_meta_data) - TLV_HDR_SIZE }, + [WMI_TAG_HW_MODE_CAPABILITIES] = { + .min_len = sizeof(struct wmi_hw_mode_capabilities) - TLV_HDR_SIZE }, }; #define PRIMAP(_hw_mode_) \ -- 2.34.1