[PATCH 1/5] wifi: ath11k: validate DMA buffer release TLV lengths

[Jiale Yao]

The DMA buffer release parser counts nested entry and metadata TLVs, but
does not ensure their payloads cover the structures later indexed by
the direct buffer ring handler.  Short firmware TLVs can therefore lead
to out-of-bounds reads when the arrays are consumed.

Add minimum-length policies for both nested TLV types.

Fixes: 9d11b7bff950 ("ath11k: add support for spectral scan")
Cc: stable at vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02 at 163.com>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 08fd6795ed9e..0d4481a09501 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -161,6 +161,10 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = {
 		.min_len = sizeof(struct wmi_p2p_noa_event) },
 	[WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] = {
 		.min_len = sizeof(struct wmi_pdev_csa_switch_ev) },
+	[WMI_TAG_DMA_BUF_RELEASE_ENTRY] = {
+		.min_len = sizeof(struct wmi_dma_buf_release_entry) - TLV_HDR_SIZE },
+	[WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = {
+		.min_len = sizeof(struct wmi_dma_buf_release_meta_data) - TLV_HDR_SIZE },
 };
 
 #define PRIMAP(_hw_mode_) \
-- 
2.34.1