The DMA buffer release parser counts nested entry and metadata TLVs, but does not ensure their payloads cover the structures later indexed by the direct buffer ring handler. Short firmware TLVs can therefore lead to out-of-bounds reads when the arrays are consumed. Add minimum-length policies for both nested TLV types. Fixes: 9d11b7bff950 ("ath11k: add support for spectral scan") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath11k/wmi.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c index 08fd6795ed9e..ef2c2c300854 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -161,6 +161,12 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = { .min_len = sizeof(struct wmi_p2p_noa_event) }, [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] = { .min_len = sizeof(struct wmi_pdev_csa_switch_ev) }, + [WMI_TAG_DMA_BUF_RELEASE] = { + .min_len = sizeof(struct ath11k_wmi_dma_buf_release_fixed_param) }, + [WMI_TAG_DMA_BUF_RELEASE_ENTRY] = { + .min_len = sizeof(struct wmi_dma_buf_release_entry) - TLV_HDR_SIZE }, + [WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = { + .min_len = sizeof(struct wmi_dma_buf_release_meta_data) - TLV_HDR_SIZE }, }; #define PRIMAP(_hw_mode_) \ -- 2.34.1 The service-ready parser indexes hardware mode capability TLVs using the full structure stride and reads their PHY maps without validating the firmware-declared payload length. A short TLV can therefore cause an out-of-bounds read. Add a minimum-length policy for hardware mode capability TLVs. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath11k/wmi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c index ef2c2c300854..047ae8f5bb60 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -167,6 +167,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = { .min_len = sizeof(struct wmi_dma_buf_release_entry) - TLV_HDR_SIZE }, [WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = { .min_len = sizeof(struct wmi_dma_buf_release_meta_data) - TLV_HDR_SIZE }, + [WMI_TAG_HW_MODE_CAPABILITIES] = { + .min_len = sizeof(struct wmi_hw_mode_capabilities) - TLV_HDR_SIZE }, }; #define PRIMAP(_hw_mode_) \ -- 2.34.1 The service-ready parser counts DMA ring capability TLVs and later indexes the firmware array using the full structure stride. It does not validate that each TLV payload covers that structure, so a short element can cause out-of-bounds reads. Add a minimum-length policy for DMA ring capability TLVs. Fixes: bd6478559e27 ("ath11k: Add direct buffer ring support") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath11k/wmi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c index 047ae8f5bb60..4cf5f57a93e1 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -169,6 +169,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = { .min_len = sizeof(struct wmi_dma_buf_release_meta_data) - TLV_HDR_SIZE }, [WMI_TAG_HW_MODE_CAPABILITIES] = { .min_len = sizeof(struct wmi_hw_mode_capabilities) - TLV_HDR_SIZE }, + [WMI_TAG_DMA_RING_CAPABILITIES] = { + .min_len = sizeof(struct wmi_dma_ring_capabilities) - TLV_HDR_SIZE }, }; #define PRIMAP(_hw_mode_) \ -- 2.34.1 The DMA buffer release parser copies fixed parameters and counts nested entry and metadata TLVs. It does not ensure that their payloads cover the complete structures later read by the parser and direct buffer ring handler. Short firmware TLVs can therefore lead to out-of-bounds reads. Add minimum-length policies for the fixed TLV and both nested TLV types. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath12k/wmi.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c index 75b259990c79..0109f56fd429 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -209,6 +209,14 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = { .min_len = sizeof(struct wmi_obss_color_collision_event) }, [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] = { .min_len = sizeof(struct ath12k_wmi_pdev_csa_event) }, + [WMI_TAG_DMA_BUF_RELEASE] = { + .min_len = sizeof(struct ath12k_wmi_dma_buf_release_fixed_params) }, + [WMI_TAG_DMA_BUF_RELEASE_ENTRY] = { + .min_len = sizeof(struct ath12k_wmi_dma_buf_release_entry_params) - + TLV_HDR_SIZE }, + [WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = { + .min_len = sizeof(struct ath12k_wmi_dma_buf_release_meta_data_params) - + TLV_HDR_SIZE }, }; __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len) -- 2.34.1 The service-ready parsers consume hardware mode, DMA ring, and extended MAC/PHY capability TLVs as complete structures without validating their firmware-declared payload lengths. Short TLVs can therefore cause out-of-bounds reads while the capability arrays are parsed. Add minimum-length policies for all three capability TLV types. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Fixes: 1476014fadb6 ("wifi: ath12k: WMI support to process EHT capabilities") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/ath/ath12k/wmi.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c index 0109f56fd429..2e72159d20f2 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -217,6 +217,12 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = { [WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = { .min_len = sizeof(struct ath12k_wmi_dma_buf_release_meta_data_params) - TLV_HDR_SIZE }, + [WMI_TAG_HW_MODE_CAPABILITIES] = { + .min_len = sizeof(struct ath12k_wmi_hw_mode_cap_params) - TLV_HDR_SIZE }, + [WMI_TAG_DMA_RING_CAPABILITIES] = { + .min_len = sizeof(struct ath12k_wmi_dma_ring_caps_params) - TLV_HDR_SIZE }, + [WMI_TAG_MAC_PHY_CAPABILITIES_EXT] = { + .min_len = sizeof(struct ath12k_wmi_caps_ext_params) }, }; __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len) -- 2.34.1