[PATCH v2 4/5] wifi: ath12k: validate DMA buffer release TLV lengths

[Jiale Yao]

The DMA buffer release parser copies fixed parameters and counts nested
entry and metadata TLVs. It does not ensure that their payloads cover
the complete structures later read by the parser and direct buffer ring
handler. Short firmware TLVs can therefore lead to out-of-bounds reads.

Add minimum-length policies for the fixed TLV and both nested TLV types.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Cc: stable at vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02 at 163.com>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 75b259990c79..0109f56fd429 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -209,6 +209,14 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = {
 		.min_len = sizeof(struct wmi_obss_color_collision_event) },
 	[WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] = {
 		.min_len = sizeof(struct ath12k_wmi_pdev_csa_event) },
+	[WMI_TAG_DMA_BUF_RELEASE] = {
+		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_fixed_params) },
+	[WMI_TAG_DMA_BUF_RELEASE_ENTRY] = {
+		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_entry_params) -
+			   TLV_HDR_SIZE },
+	[WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = {
+		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_meta_data_params) -
+			   TLV_HDR_SIZE },
 };
 
 __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len)
-- 
2.34.1