[31m1:  9e8af434fb8a [m[33m![m[32m 1:  d91b71b1d2f4[m[33m wifi: ath11k: validate DMA buffer release TLV lengths[m
    [7m[36m@@[m [mdrivers/net/wireless/ath/ath11k/wmi.c: static const struct wmi_tlv_policy wmi_tl[m
      		.min_len = sizeof(struct wmi_p2p_noa_event) },[m
      	[WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] = {[m
      		.min_len = sizeof(struct wmi_pdev_csa_switch_ev) },[m
    [7m[32m+[m[1;32m+	[WMI_TAG_DMA_BUF_RELEASE] = {[m
    [7m[32m+[m[1;32m+		.min_len = sizeof(struct ath11k_wmi_dma_buf_release_fixed_param) },[m
    [32m +	[WMI_TAG_DMA_BUF_RELEASE_ENTRY] = {[m
    [32m +		.min_len = sizeof(struct wmi_dma_buf_release_entry) - TLV_HDR_SIZE },[m
    [32m +	[WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = {[m
[33m2:  bf49bddd1b25 = 2:  69ce2d4665ac wifi: ath11k: validate hardware mode capability TLVs[m
[33m3:  46fdca8899e4 = 3:  c14bd9d5552d wifi: ath11k: validate DMA ring capability TLVs[m
[31m4:  83c54fae31de [m[33m![m[32m 4:  25d956025f7e[m[33m wifi: ath12k: validate DMA buffer release fixed TLV length[m
    [7m[36m@@[m [mMetadata[m
     Author: Jiale Yao <yaojiale02@163.com>[m
     [m
      ## Commit message ##[m
    [7m[31m-[m[2m    wifi: ath12k: validate DMA buffer release fixed TLV length[m
    [7m[32m+[m[1m    wifi: ath12k: validate DMA buffer release TLV lengths[m
     [m
    [7m[31m-[m[2m    The DMA buffer release parser copies the fixed parameters from a[m
    [7m[31m-[m[2m    firmware TLV without checking that its payload contains the complete[m
    [7m[31m-[m[2m    structure.  A short TLV can therefore make the structure copy read past[m
    [7m[31m-[m[2m    the declared payload.[m
    [7m[32m+[m[1m    The DMA buffer release parser copies fixed parameters and counts nested[m
    [7m[32m+[m[1m    entry and metadata TLVs. It does not ensure that their payloads cover[m
    [7m[32m+[m[1m    the complete structures later read by the parser and direct buffer ring[m
    [7m[32m+[m[1m    handler. Short firmware TLVs can therefore lead to out-of-bounds reads.[m
     [m
    [7m[31m-[m[2m    Add a minimum-length policy for the fixed DMA buffer release TLV.[m
    [7m[32m+[m[1m    Add minimum-length policies for the fixed TLV and both nested TLV types.[m
     [m
         Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")[m
         Cc: stable@vger.kernel.org[m
    [7m[36m@@[m [mdrivers/net/wireless/ath/ath12k/wmi.c: static const struct ath12k_wmi_tlv_policy[m
      		.min_len = sizeof(struct ath12k_wmi_pdev_csa_event) },[m
    [32m +	[WMI_TAG_DMA_BUF_RELEASE] = {[m
    [32m +		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_fixed_params) },[m
    [7m[32m+[m[1;32m+	[WMI_TAG_DMA_BUF_RELEASE_ENTRY] = {[m
    [7m[32m+[m[1;32m+		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_entry_params) -[m
    [7m[32m+[m[1;32m+			   TLV_HDR_SIZE },[m
    [7m[32m+[m[1;32m+	[WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = {[m
    [7m[32m+[m[1;32m+		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_meta_data_params) -[m
    [7m[32m+[m[1;32m+			   TLV_HDR_SIZE },[m
      };[m
      [m
      __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len)[m
[31m5:  da4e4a764b45 [m[33m![m[32m 5:  de7e1681834b[m[33m wifi: ath12k: validate service-ready capability TLV lengths[m
    [7m[36m@@[m [mCommit message[m
     [m
      ## drivers/net/wireless/ath/ath12k/wmi.c ##[m
    [36m @@ drivers/net/wireless/ath/ath12k/wmi.c: static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = {[m
    [7m[31m-[m[2m 		.min_len = sizeof(struct ath12k_wmi_pdev_csa_event) },[m
    [7m[31m-[m[2m 	[WMI_TAG_DMA_BUF_RELEASE] = {[m
    [7m[31m-[m[2m 		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_fixed_params) },[m
    [7m[32m+[m[1m 	[WMI_TAG_DMA_BUF_RELEASE_SPECTRAL_META_DATA] = {[m
    [7m[32m+[m[1m 		.min_len = sizeof(struct ath12k_wmi_dma_buf_release_meta_data_params) -[m
    [7m[32m+[m[1m 			   TLV_HDR_SIZE },[m
    [32m +	[WMI_TAG_HW_MODE_CAPABILITIES] = {[m
    [32m +		.min_len = sizeof(struct ath12k_wmi_hw_mode_cap_params) - TLV_HDR_SIZE },[m
    [32m +	[WMI_TAG_DMA_RING_CAPABILITIES] = {[m