Re: [PATCH ath-next] wifi: ath12k: validate TLV length in process_tpc_stats()
Jeff Johnson <[email protected]>
| Newsgroups | org.kernel.vger.linux-wireless,org.infradead.lists.ath12k,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 26 Jul 2026 16:02:07 -0700, Jeff Johnson wrote:
> The outer skb->len guard only confirms the SKB is large enough
> to hold the full fixed_param struct, but the TLV's own WMI_TLV_LEN
> field is never checked. Firmware advertising a TLV length shorter
> than sizeof(*fixed_param) causes reads of pdev_id and event_count
> beyond the declared TLV payload.
>
> Add a check that the TLV length is at least sizeof(*fixed_param)
> before casting and dereferencing the pointer.
>
> [...]
Applied, thanks!
[1/1] wifi: ath12k: validate TLV length in process_tpc_stats()
commit: 8e415b8068480d51a057197ded974e2637e8c42b
Best regards,
--
Jeff Johnson <[email protected]>