Re: [PATCH] wifi: ath11k: validate regulatory capability phy_id
Baochen Qiang <[email protected]> Mon, 13 Jul 2026 14:22:06 +0800
| Newsgroups | org.infradead.lists.ath11k,org.kernel.vger.linux-kernel,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <[email protected]> |
On 7/4/2026 9:10 AM, Pengpeng Hou wrote: > ath11k_wmi_tlv_ext_hal_reg_caps() copies firmware regulatory > capability records into soc->hal_reg_cap[] using reg_cap.phy_id as > the destination index. The loop count is bounded by num_phy, but the > phy_id embedded in each record is not checked against the fixed > MAX_RADIOS-sized destination array. > > Reject firmware records whose phy_id does not fit soc->hal_reg_cap[] > before copying the parsed capability. > > Signed-off-by: Pengpeng Hou <[email protected]> Reviewed-by: Baochen Qiang <[email protected]>