[PATCH 0/4] wifi: ath11k/ath12k: validate firmware array lengths

[Jeff Johnson]

On 10/19/2026 7:19 PM, jiale yao wrote:
> This patch series is superseded — please ignore it due to the incorrect sender name.
> New one is https://lore.kernel.org/lkml/20261019100506.1915181-1-yaojiale02@163.com

Please do not top post and don't send HTML e-mail since it is rejected by the
mailing lists. Please make sure you understand Linux Kernel e-mail etiquette.

You are close to going on my ignore list...

/jeff
> At 2026-10-19 18:00:25, "Jiale Yao" <yaojiale02 at 163.com> wrote:
>> From: Jiale Yao <jiale.yao at example.com>
>>
>> ath11k and ath12k consume two firmware-provided arrays without fully
>> validating their lengths. The service-ready-ext parser accepts fewer
>> extended regulatory capability entries than the separately reported PHY
>> count, while the ready-event parser trusts the reported extra MAC address
>> count without checking the fixed-structure array length.
>>
>> Malformed firmware data can therefore make both drivers read beyond the
>> corresponding TLV arrays. Add matching validation to each driver before
>> the arrays are indexed.
>>
>> The four patches are independent and each addresses one parsing path in
>> one driver.
>>
>> Jiale Yao (4):
>>  wifi: ath11k: validate extended regulatory capability count
>>  wifi: ath12k: validate extended regulatory capability count
>>  wifi: ath11k: validate ready event MAC address array length
>>  wifi: ath12k: validate ready event MAC address array length
>>
>> drivers/net/wireless/ath/ath11k/wmi.c | 10 ++++++++++
>> drivers/net/wireless/ath/ath12k/wmi.c | 10 ++++++++++
>> 2 files changed, 20 insertions(+)
>>
>> -- 
>> 2.34.1