[PATCH 0/5] wifi: ath11k/ath12k: validate capability TLV lengths

[Jiale Yao]

Several ath11k and ath12k WMI parsers count firmware TLVs and later
consume them as arrays of complete capability structures.  The generic
iterator validates that a TLV fits in its enclosing message, but these
tags have no minimum-length policies, so a short element can still cause
an out-of-bounds structure read.

Add policies for the DMA buffer release, hardware mode, DMA ring, and
extended MAC/PHY capability TLVs used by these paths.

Jiale Yao (5):
  wifi: ath11k: validate DMA buffer release TLV lengths
  wifi: ath11k: validate hardware mode capability TLVs
  wifi: ath11k: validate DMA ring capability TLVs
  wifi: ath12k: validate DMA buffer release fixed TLV length
  wifi: ath12k: validate service-ready capability TLV lengths

 drivers/net/wireless/ath/ath11k/wmi.c | 8 ++++++++
 drivers/net/wireless/ath/ath12k/wmi.c | 8 ++++++++
 2 files changed, 16 insertions(+)

-- 
2.34.1