[PATCH v2 0/5] wifi: ath11k/ath12k: validate capability TLV lengths

[Jiale Yao]

Several ath11k and ath12k WMI parsers copy fixed firmware TLVs or count
nested TLVs and later consume them as complete capability structures.
The generic iterator validates that a TLV fits in its enclosing message,
but these tags have no minimum-length policies, so a short element can
still cause an out-of-bounds structure read.

Add policies for the DMA buffer release, hardware mode, DMA ring, and
extended MAC/PHY capability TLVs used by these paths.

Changes in v2:
- Validate both the fixed and nested DMA buffer release TLVs in ath11k
  and ath12k.

Jiale Yao (5):
  wifi: ath11k: validate DMA buffer release TLV lengths
  wifi: ath11k: validate hardware mode capability TLVs
  wifi: ath11k: validate DMA ring capability TLVs
  wifi: ath12k: validate DMA buffer release TLV lengths
  wifi: ath12k: validate service-ready capability TLV lengths

 drivers/net/wireless/ath/ath11k/wmi.c | 10 ++++++++++
 drivers/net/wireless/ath/ath12k/wmi.c | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

-- 
2.34.1