[PATCH 5/5] wifi: ath12k: validate service-ready capability TLV lengths

[Jiale Yao]

The service-ready parsers consume hardware mode, DMA ring, and extended
MAC/PHY capability TLVs as complete structures without validating their
firmware-declared payload lengths.  Short TLVs can therefore cause
out-of-bounds reads while the capability arrays are parsed.

Add minimum-length policies for all three capability TLV types.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Fixes: 1476014fadb6 ("wifi: ath12k: WMI support to process EHT capabilities")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index ea7771a2eea9..730dde686626 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -211,6 +211,12 @@ static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = {
 		.min_len = sizeof(struct ath12k_wmi_pdev_csa_event) },
 	[WMI_TAG_DMA_BUF_RELEASE] = {
 		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_fixed_params) },
+	[WMI_TAG_HW_MODE_CAPABILITIES] = {
+		.min_len = sizeof(struct ath12k_wmi_hw_mode_cap_params) - TLV_HDR_SIZE },
+	[WMI_TAG_DMA_RING_CAPABILITIES] = {
+		.min_len = sizeof(struct ath12k_wmi_dma_ring_caps_params) - TLV_HDR_SIZE },
+	[WMI_TAG_MAC_PHY_CAPABILITIES_EXT] = {
+		.min_len = sizeof(struct ath12k_wmi_caps_ext_params) },
 };
 
 __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len)
-- 
2.34.1