The service-ready parsers consume hardware mode, DMA ring, and extended MAC/PHY capability TLVs as complete structures without validating their firmware-declared payload lengths. Short TLVs can therefore cause out-of-bounds reads while the capability arrays are parsed. Add minimum-length policies for all three capability TLV types. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Fixes: 1476014fadb6 ("wifi: ath12k: WMI support to process EHT capabilities") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath12k/wmi.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c index 0109f56fd429..2e72159d20f2 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -217,6 +217,12 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = { [WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = { .min_len = sizeof(struct ath12k_wmi_dma_buf_release_meta_data_params) - TLV_HDR_SIZE }, + [WMI_TAG_HW_MODE_CAPABILITIES] = { + .min_len = sizeof(struct ath12k_wmi_hw_mode_cap_params) - TLV_HDR_SIZE }, + [WMI_TAG_DMA_RING_CAPABILITIES] = { + .min_len = sizeof(struct ath12k_wmi_dma_ring_caps_params) - TLV_HDR_SIZE }, + [WMI_TAG_MAC_PHY_CAPABILITIES_EXT] = { + .min_len = sizeof(struct ath12k_wmi_caps_ext_params) }, }; __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len) -- 2.34.1