[PATCH v2 3/5] wifi: ath11k: validate DMA ring capability TLVs

[Jiale Yao]

The service-ready parser counts DMA ring capability TLVs and later
indexes the firmware array using the full structure stride.  It does not
validate that each TLV payload covers that structure, so a short element
can cause out-of-bounds reads.

Add a minimum-length policy for DMA ring capability TLVs.

Fixes: bd6478559e27 ("ath11k: Add direct buffer ring support")
Cc: stable at vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02 at 163.com>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 047ae8f5bb60..4cf5f57a93e1 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -169,6 +169,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = {
 		.min_len = sizeof(struct wmi_dma_buf_release_meta_data) - TLV_HDR_SIZE },
 	[WMI_TAG_HW_MODE_CAPABILITIES] = {
 		.min_len = sizeof(struct wmi_hw_mode_capabilities) - TLV_HDR_SIZE },
+	[WMI_TAG_DMA_RING_CAPABILITIES] = {
+		.min_len = sizeof(struct wmi_dma_ring_capabilities) - TLV_HDR_SIZE },
 };
 
 #define PRIMAP(_hw_mode_) \
-- 
2.34.1