The DMA buffer release parser copies the fixed parameters from a firmware TLV without checking that its payload contains the complete structure. A short TLV can therefore make the structure copy read past the declared payload. Add a minimum-length policy for the fixed DMA buffer release TLV. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath12k/wmi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c index 75b259990c79..ea7771a2eea9 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -209,6 +209,8 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = { .min_len = sizeof(struct wmi_obss_color_collision_event) }, [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] = { .min_len = sizeof(struct ath12k_wmi_pdev_csa_event) }, + [WMI_TAG_DMA_BUF_RELEASE] = { + .min_len = sizeof(struct ath12k_wmi_dma_buf_release_fixed_params) }, }; __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len) -- 2.34.1