| Message ID | 20240704070811.4186543-2-quic_periyasa@quicinc.com |
|---|---|
| State | New |
| Headers | show |
| Series | wifi: ath: fix array out-of-bound access in SoC stats | expand |
On 7/4/2024 12:08 AM, Karthikeyan Periyasamy wrote: > Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a > maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process() > function access ath12k_soc_dp_stats::hal_reo_error using the REO > destination SRNG ring ID, which is incorrect. SRNG ring ID differ from > normal ring ID, and this usage leads to out-of-bounds array access. To > fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID > directly instead of the SRNG ring ID to avoid out-of-bounds array access. > > Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 > > Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Karthikeyan Periyasamy <quic_periyasa@quicinc.com> wrote: > Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a > maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process() > function access ath12k_soc_dp_stats::hal_reo_error using the REO > destination SRNG ring ID, which is incorrect. SRNG ring ID differ from > normal ring ID, and this usage leads to out-of-bounds array access. To > fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID > directly instead of the SRNG ring ID to avoid out-of-bounds array access. > > Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 > > Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com> > Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> 2 patches applied to ath-next branch of ath.git, thanks. e106b7ad13c1 wifi: ath12k: fix array out-of-bound access in SoC stats 69f253e46af9 wifi: ath11k: fix array out-of-bound access in SoC stats
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c index 14236d0a0c89..91e3393f7b5f 100644 --- a/drivers/net/wireless/ath/ath12k/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c @@ -2681,7 +2681,7 @@ int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id, if (push_reason != HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) { dev_kfree_skb_any(msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++; continue; }
Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process() function access ath12k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com> --- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)