[PATCH 0/4] wifi: ath11k/ath12k: validate firmware array lengths

[jiale yao]

This patch series is superseded — please ignore it due to the incorrect sender name.
New one is https://lore.kernel.org/lkml/20261019100506.1915181-1-yaojiale02@163.com
At 2026-10-19 18:00:25, "Jiale Yao" <yaojiale02 at 163.com> wrote:
>From: Jiale Yao <jiale.yao at example.com>
>
>ath11k and ath12k consume two firmware-provided arrays without fully
>validating their lengths. The service-ready-ext parser accepts fewer
>extended regulatory capability entries than the separately reported PHY
>count, while the ready-event parser trusts the reported extra MAC address
>count without checking the fixed-structure array length.
>
>Malformed firmware data can therefore make both drivers read beyond the
>corresponding TLV arrays. Add matching validation to each driver before
>the arrays are indexed.
>
>The four patches are independent and each addresses one parsing path in
>one driver.
>
>Jiale Yao (4):
>  wifi: ath11k: validate extended regulatory capability count
>  wifi: ath12k: validate extended regulatory capability count
>  wifi: ath11k: validate ready event MAC address array length
>  wifi: ath12k: validate ready event MAC address array length
>
> drivers/net/wireless/ath/ath11k/wmi.c | 10 ++++++++++
> drivers/net/wireless/ath/ath12k/wmi.c | 10 ++++++++++
> 2 files changed, 20 insertions(+)
>
>-- 
>2.34.1