[PATCH 0/4] wifi: ath11k/ath12k: validate firmware array lengths

[PATCH 0/4] wifi: ath11k/ath12k: validate firmware array lengths

[Jiale Yao]

From: Jiale Yao <jiale.yao@example.com>

ath11k and ath12k consume two firmware-provided arrays without fully
validating their lengths. The service-ready-ext parser accepts fewer
extended regulatory capability entries than the separately reported PHY
count, while the ready-event parser trusts the reported extra MAC address
count without checking the fixed-structure array length.

Malformed firmware data can therefore make both drivers read beyond the
corresponding TLV arrays. Add matching validation to each driver before
the arrays are indexed.

The four patches are independent and each addresses one parsing path in
one driver.

Jiale Yao (4):
  wifi: ath11k: validate extended regulatory capability count
  wifi: ath12k: validate extended regulatory capability count
  wifi: ath11k: validate ready event MAC address array length
  wifi: ath12k: validate ready event MAC address array length

 drivers/net/wireless/ath/ath11k/wmi.c | 10 ++++++++++
 drivers/net/wireless/ath/ath12k/wmi.c | 10 ++++++++++
 2 files changed, 20 insertions(+)

-- 
2.34.1

[PATCH 1/4] wifi: ath11k: validate extended regulatory capability count

[Jiale Yao]

From: Jiale Yao <jiale.yao@example.com>

Firmware reports the number of PHYs separately from the array of
extended regulatory capabilities. The TLV parser rejects excess array
entries, but accepts an array with fewer entries than the reported PHY
count. The subsequent loop uses the reported count and reads beyond the
supplied array.

Reject mismatched counts before indexing the capability array.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Jiale Yao <jiale.yao@example.com>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index bbca275a8289..995fee2ffdfa 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -4859,6 +4859,13 @@ static int ath11k_wmi_tlv_ext_hal_reg_caps(struct ath11k_base *soc,
 		return ret;
 	}
 
+	if (svc_rdy_ext->n_ext_hal_reg_caps != svc_rdy_ext->param.num_phy) {
+		ath11k_warn(soc, "invalid number of reg caps %u, expected %u\n",
+			    svc_rdy_ext->n_ext_hal_reg_caps,
+			    svc_rdy_ext->param.num_phy);
+		return -EINVAL;
+	}
+
 	for (i = 0; i < svc_rdy_ext->param.num_phy; i++) {
 		ret = ath11k_pull_reg_cap_svc_rdy_ext(wmi_handle,
 						      svc_rdy_ext->soc_hal_reg_caps,
-- 
2.34.1

[PATCH 2/4] wifi: ath12k: validate extended regulatory capability count

[Jiale Yao]

From: Jiale Yao <jiale.yao@example.com>

Firmware reports the number of PHYs separately from the array of
extended regulatory capabilities. The TLV parser rejects excess array
entries, but accepts an array with fewer entries than the reported PHY
count. The subsequent loop uses the reported count and reads beyond the
supplied array.

Reject mismatched counts before indexing the capability array.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Jiale Yao <jiale.yao@example.com>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index d5160af60e00..66e39672dcda 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4824,6 +4824,13 @@ static int ath12k_wmi_ext_hal_reg_caps(struct ath12k_base *soc,
 		return ret;
 	}
 
+	if (svc_rdy_ext->n_ext_hal_reg_caps != svc_rdy_ext->arg.num_phy) {
+		ath12k_warn(soc, "invalid number of reg caps %u, expected %u\n",
+			    svc_rdy_ext->n_ext_hal_reg_caps,
+			    svc_rdy_ext->arg.num_phy);
+		return -EINVAL;
+	}
+
 	for (i = 0; i < svc_rdy_ext->arg.num_phy; i++) {
 		ret = ath12k_pull_reg_cap_svc_rdy_ext(wmi_handle,
 						      svc_rdy_ext->soc_hal_reg_caps,
-- 
2.34.1

[PATCH 3/4] wifi: ath11k: validate ready event MAC address array length

[Jiale Yao]

From: Jiale Yao <jiale.yao@example.com>

The ready event reports the number of extra MAC addresses separately
from the fixed-structure address array. ath11k checks the reported
count before assigning addresses to radios, but does not check the
length of the array TLV. A truncated array therefore causes reads past
the supplied event data.

Validate the array capacity before copying any addresses.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Jiale Yao <jiale.yao@example.com>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 995fee2ffdfa..9a048c7d9858 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -7328,6 +7328,9 @@ static int ath11k_wmi_tlv_rdy_parse(struct ath11k_base *ab, u16 tag, u16 len,
 		if (!(ab->num_radios > 1 && num_mac_addr >= ab->num_radios))
 			break;
 
+		if (len / sizeof(*addr_list) < ab->num_radios)
+			return -EINVAL;
+
 		for (i = 0; i < ab->num_radios; i++) {
 			pdev = &ab->pdevs[i];
 			ether_addr_copy(pdev->mac_addr, addr_list[i].addr);
-- 
2.34.1

[PATCH 4/4] wifi: ath12k: validate ready event MAC address array length

[Jiale Yao]

From: Jiale Yao <jiale.yao@example.com>

The ready event reports the number of extra MAC addresses separately
from the fixed-structure address array. ath12k checks the reported
count before assigning addresses to radios, but does not check the
length of the array TLV. A truncated array therefore causes reads past
the supplied event data.

Validate the array capacity before copying any addresses.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Jiale Yao <jiale.yao@example.com>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 66e39672dcda..0ae366e8a944 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -7082,6 +7082,9 @@ static int ath12k_wmi_rdy_parse(struct ath12k_base *ab, u16 tag, u16 len,
 		if (!(ab->num_radios > 1 && num_mac_addr >= ab->num_radios))
 			break;
 
+		if (len / sizeof(*addr_list) < ab->num_radios)
+			return -EINVAL;
+
 		for (i = 0; i < ab->num_radios; i++) {
 			pdev = &ab->pdevs[i];
 			ether_addr_copy(pdev->mac_addr, addr_list[i].addr);
-- 
2.34.1

Re:[PATCH 0/4] wifi: ath11k/ath12k: validate firmware array lengths

[jiale yao]

This patch series is superseded — please ignore it due to the incorrect sender name.
New one is https://lore.kernel.org/lkml/20261019100506.1915181-1-yaojiale02@163.com
At 2026-10-19 18:00:25, "Jiale Yao" <yaojiale02@163.com> wrote:
>From: Jiale Yao <jiale.yao@example.com>
>
>ath11k and ath12k consume two firmware-provided arrays without fully
>validating their lengths. The service-ready-ext parser accepts fewer
>extended regulatory capability entries than the separately reported PHY
>count, while the ready-event parser trusts the reported extra MAC address
>count without checking the fixed-structure array length.
>
>Malformed firmware data can therefore make both drivers read beyond the
>corresponding TLV arrays. Add matching validation to each driver before
>the arrays are indexed.
>
>The four patches are independent and each addresses one parsing path in
>one driver.
>
>Jiale Yao (4):
>  wifi: ath11k: validate extended regulatory capability count
>  wifi: ath12k: validate extended regulatory capability count
>  wifi: ath11k: validate ready event MAC address array length
>  wifi: ath12k: validate ready event MAC address array length
>
> drivers/net/wireless/ath/ath11k/wmi.c | 10 ++++++++++
> drivers/net/wireless/ath/ath12k/wmi.c | 10 ++++++++++
> 2 files changed, 20 insertions(+)
>
>-- 
>2.34.1

[PATCH 0/4] wifi: ath11k/ath12k: validate firmware array lengths

[Jiale Yao]

ath11k and ath12k consume two firmware-provided arrays without fully
validating their lengths. The service-ready-ext parser accepts fewer
extended regulatory capability entries than the separately reported PHY
count, while the ready-event parser trusts the reported extra MAC address
count without checking the fixed-structure array length.

Malformed firmware data can therefore make both drivers read beyond the
corresponding TLV arrays. Add matching validation to each driver before
the arrays are indexed.

The four patches are independent and each addresses one parsing path in
one driver.

Jiale Yao (4):
  wifi: ath11k: validate extended regulatory capability count
  wifi: ath12k: validate extended regulatory capability count
  wifi: ath11k: validate ready event MAC address array length
  wifi: ath12k: validate ready event MAC address array length

 drivers/net/wireless/ath/ath11k/wmi.c | 10 ++++++++++
 drivers/net/wireless/ath/ath12k/wmi.c | 10 ++++++++++
 2 files changed, 20 insertions(+)

-- 
2.34.1

[PATCH 2/4] wifi: ath12k: validate extended regulatory capability count

[Jiale Yao]

Firmware reports the number of PHYs separately from the array of
extended regulatory capabilities. The TLV parser rejects excess array
entries, but accepts an array with fewer entries than the reported PHY
count. The subsequent loop uses the reported count and reads beyond the
supplied array.

Reject mismatched counts before indexing the capability array.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index d5160af60e00..66e39672dcda 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4824,6 +4824,13 @@ static int ath12k_wmi_ext_hal_reg_caps(struct ath12k_base *soc,
 		return ret;
 	}
 
+	if (svc_rdy_ext->n_ext_hal_reg_caps != svc_rdy_ext->arg.num_phy) {
+		ath12k_warn(soc, "invalid number of reg caps %u, expected %u\n",
+			    svc_rdy_ext->n_ext_hal_reg_caps,
+			    svc_rdy_ext->arg.num_phy);
+		return -EINVAL;
+	}
+
 	for (i = 0; i < svc_rdy_ext->arg.num_phy; i++) {
 		ret = ath12k_pull_reg_cap_svc_rdy_ext(wmi_handle,
 						      svc_rdy_ext->soc_hal_reg_caps,
-- 
2.34.1