[PATCH 0/4] wifi: ath11k/ath12k: validate firmware array lengths

[Jeff Johnson]

On 10/19/2026 3:05 AM, Jiale Yao wrote:
> ath11k and ath12k consume two firmware-provided arrays without fully
> validating their lengths. The service-ready-ext parser accepts fewer
> extended regulatory capability entries than the separately reported PHY
> count, while the ready-event parser trusts the reported extra MAC address
> count without checking the fixed-structure array length.
> 
> Malformed firmware data can therefore make both drivers read beyond the
> corresponding TLV arrays. Add matching validation to each driver before
> the arrays are indexed.
> 
> The four patches are independent and each addresses one parsing path in
> one driver.
> 
> Jiale Yao (4):
>   wifi: ath11k: validate extended regulatory capability count
>   wifi: ath12k: validate extended regulatory capability count
>   wifi: ath11k: validate ready event MAC address array length
>   wifi: ath12k: validate ready event MAC address array length
> 
>  drivers/net/wireless/ath/ath11k/wmi.c | 10 ++++++++++
>  drivers/net/wireless/ath/ath12k/wmi.c | 10 ++++++++++
>  2 files changed, 20 insertions(+)
> 

(dropping obsolete codeaurora and quicinc addresses)

You seem to have sent two separate series. Which is the correct one to review?

And more importantly, where are the Tested-on: tags which indicate you
actually tested these changes on real hardware? There have been numerous LLM
inspired code changes lately, and some of them have caused regressions, so you
must test your changes on real hardware to be considered.

https://wireless.docs.kernel.org/en/latest/en/users/drivers/ath11k/submittingpatches.html#tested-on-tag
https://wireless.docs.kernel.org/en/latest/en/users/drivers/ath12k/submittingpatches.html#tested-on-tag

/jeff