Re: [PATCH] wifi: ath11k: validate regulatory capability phy_id
Rameshkumar Sundaram <[email protected]> Mon, 13 Jul 2026 14:59:22 +0530
| Newsgroups | org.infradead.lists.ath11k,org.kernel.vger.linux-kernel,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <[email protected]> |
On 7/4/2026 6:40 AM, Pengpeng Hou wrote: > ath11k_wmi_tlv_ext_hal_reg_caps() copies firmware regulatory > capability records into soc->hal_reg_cap[] using reg_cap.phy_id as > the destination index. The loop count is bounded by num_phy, but the > phy_id embedded in each record is not checked against the fixed > MAX_RADIOS-sized destination array. > > Reject firmware records whose phy_id does not fit soc->hal_reg_cap[] > before copying the parsed capability. > > Signed-off-by: Pengpeng Hou <[email protected]> Reviewed-by: Rameshkumar Sundaram <[email protected]>