From: Jiale Yao Firmware reports the number of PHYs separately from the array of extended regulatory capabilities. The TLV parser rejects excess array entries, but accepts an array with fewer entries than the reported PHY count. The subsequent loop uses the reported count and reads beyond the supplied array. Reject mismatched counts before indexing the capability array. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath11k/wmi.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c index bbca275a8289..995fee2ffdfa 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -4859,6 +4859,13 @@ static int ath11k_wmi_tlv_ext_hal_reg_caps(struct ath11k_base *soc, return ret; } + if (svc_rdy_ext->n_ext_hal_reg_caps != svc_rdy_ext->param.num_phy) { + ath11k_warn(soc, "invalid number of reg caps %u, expected %u\n", + svc_rdy_ext->n_ext_hal_reg_caps, + svc_rdy_ext->param.num_phy); + return -EINVAL; + } + for (i = 0; i < svc_rdy_ext->param.num_phy; i++) { ret = ath11k_pull_reg_cap_svc_rdy_ext(wmi_handle, svc_rdy_ext->soc_hal_reg_caps, -- 2.34.1