From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CBAB3C1D71 for ; Wed, 29 Jul 2026 15:26:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785338795; cv=none; b=rY3g6JBA7M/gI3sxUv00P5mFQnwlPTrIiAKiteUSTN7jO4xP+arnWIBfVkxahUTlh8/obQv7XBbmVKembFlomGhsEiKl8Rc4u12jPtELTGRlZ44I1kLSPhSiSj2iC4TXL2FzDrUBtDdnF2+eVpYcNPXtKc4z0/GozZwhSxv+qEY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785338795; c=relaxed/simple; bh=rtsd5Eu05gTWl9eJA3CFTXLHvsxmuN60s29cbVTL3q8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=QpUkMA/yp4IgpopTtIW6Ian9H/4IfUaXle8WH4hzx022+xYnF87GaXLiAmAxHSoAJLWpmh4aiOl5xivH2QDOmGBH3lwRTmeYYxDICKwBMmMun5TqDbrrZ/JdYutPBD572oMKJjiWfp8+U1RKP3wQrK8xf6WG5RDkGT/kvBM89oE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=oBoQKMK9; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=d2LJFU/d; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="oBoQKMK9"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="d2LJFU/d" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66TF2sYP2396995 for ; Wed, 29 Jul 2026 15:26:30 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= TNT5GXQJAMiAcSilkiUxETqrPzWUif0/ef1SRCtWtiA=; b=oBoQKMK9ee9Ob5sR zUwfVCqHvn0fjGg5+CtDAbD6MBit2H5Hq/yMhiK9RC0aaOv+GvaTG3ky4d5VQhGs NsI4p9Xk9rNC7B30y5lrXU2cwzrMa5I1zd7ZcyEC6ZyLWt1hIeU62m4iXN7AlicZ eyju1C4ay2xFMpeF90Fpkq+44CuS6MDOcM07D+onU/mcA1z4+YE2+aFI0Nv4p7Ux 5GO3NCJrpxJHnzYBZmEn2/QmMTCgefikJdWBv7okHcqI/WdffZ9zZUCNpDCuBL7a QM9YupFw6EwsvJ6XTQS5L3O7C18JuLb+Rm9gk1eQETb/KXnFyLy3nMCaNCeYhHzi KTPapA== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fqgr693vj-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 29 Jul 2026 15:26:30 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2cf6acd760cso14080925ad.3 for ; Wed, 29 Jul 2026 08:26:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785338790; x=1785943590; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TNT5GXQJAMiAcSilkiUxETqrPzWUif0/ef1SRCtWtiA=; b=d2LJFU/dybtixu9mHTtspG0S3WmN/WWzVbokjvyds8RCLkrEQAWxg6vh1HoxVeE7cq td+lHqRvaUDkxSwOQAKvNypVbvSl8gci1bLVBJTdpio9CDd78C66iEppg7Vm1IH1NwPK UQFS+TkdHxxQTyOXOvdygamTviv95eqbVwPPXIGGYgE6JFqNpnIAmlFVrYV1XfokY0IH Lzi7s2ZiEX7Lb2c1rqac+hHud0kzlgp4KOVrsAfZFoDn23uG6kEyhOixW5d4V5kVUvG2 4HE3bWsw2LGMe2IkfoQRHlHMIMEryRZRdKMKBPG+6R8bXJQ6Us0YF86ZCDm+KYh/MipV j5Yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785338790; x=1785943590; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=TNT5GXQJAMiAcSilkiUxETqrPzWUif0/ef1SRCtWtiA=; b=o+DzcP6Umk/+W1YKQQXN6zgyw3AlJmw6uQfrdVt0a92soO/DZ+D7h1KkJrUCYn7ZhA UlrjQDy5trEzZgqXRqPXAw4mkBWyYsHBU8foJC7kvEWIW9YP4WsbKSIQgjn7Y9EiIgdE F4H2tyi/AYiYT9Gll4w9wYW7ZQRZidSQ71I4i9qYJfle0d/gltRdTUhoLseUo3lvn3z4 9NKdTdnfhzHHzVCtWNuhXADXs1ke6BtpQPiVvnUY8xKKeRnWGDtlA05AL7lMssuBKOek cEmF0ausEle1ffvszz1mXcWzo41yAyBDwAxMOVmHm2L1xYq0ntT19eAPfcQxUvP5lDH2 rDnw== X-Forwarded-Encrypted: i=1; AHgh+RqIFcYhXzR49ImSB7S1bm4yezsk8D3vplOprncEBSL8hJ4QJ+VV6hKnnM3i8CnxUJ5/mYLoEVXOxzNq9bQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yx3dl/dGOgXU98izUpwzrhKQ0gTWEb3j09evLd8xqpG9Ma/+cMw rYWyD4T6xOCiWJOWEfCnw7YlFfVrYuMFZc+fTJ/fwa6NgpJubPHufT7VaqB24BnG+olapin/hyv YGSgaIRLp1AunWbs4fCsFxuWmaRUPSxfpTO2QjbCe0sqI4taGIcHRPss9WuhIBvXEnoE= X-Gm-Gg: AR+sD12li30gRC6KOuE1nROhG7yXZIGtsvw6V44ead33WByN7BYJPqjWIbaJ0y4DcWL YiDsi/oriHbfbb74NDfg9cxGiuiv4BKZwRAUZ9tSOOcMFuaRhUJ9P0dyFadl0yuHblBwkgUtYQf IG7fYc+i9+7btLzI/JdFvwMyizC9GJK4NV2CEQy8AGIRtb5RBqDEr/C2Eoi12GmedZGj3aNiM5J aRaSUwdz7nh3OysUjwADA4WWfIoYjReW6YiMvhf2zQMjIpryImfq4YkFFwc/4qMt8Z/o+1xgyMO vkViSlJkMw81XUDTpXonL3TVLScrHsNEe+zMQoO5qmRi82Jzt+VGcQX6bb1lPD5O5w7ypJLBkCJ ov6REVQ7T7iPo/h/VybrcRizwAK0g0VA9mZnWc+6/YxRfp4hzhj4t5GM= X-Received: by 2002:a17:903:3c6e:b0:2c9:d539:61e7 with SMTP id d9443c01a7336-2d015c4e34bmr81145125ad.19.1785338789592; Wed, 29 Jul 2026 08:26:29 -0700 (PDT) X-Received: by 2002:a17:903:3c6e:b0:2c9:d539:61e7 with SMTP id d9443c01a7336-2d015c4e34bmr81144805ad.19.1785338789207; Wed, 29 Jul 2026 08:26:29 -0700 (PDT) Received: from hu-jjohnson-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31504d480c5sm18005300eec.25.2026.07.29.08.26.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 08:26:28 -0700 (PDT) From: Jeff Johnson Date: Wed, 29 Jul 2026 08:26:25 -0700 Subject: [PATCH ath-next 1/2] wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260729-mac_phy_caps_parse-stride-mismatch-v1-1-077a1a0c50d8@oss.qualcomm.com> References: <20260729-mac_phy_caps_parse-stride-mismatch-v1-0-077a1a0c50d8@oss.qualcomm.com> In-Reply-To: <20260729-mac_phy_caps_parse-stride-mismatch-v1-0-077a1a0c50d8@oss.qualcomm.com> To: Jeff Johnson Cc: ath11k@lists.infradead.org, ath12k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Jeff Johnson X-Mailer: b4 0.14.3 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDEyNCBTYWx0ZWRfX4g/PKKv0sBwR w72wJ/4YZ9yWO354UcUBw3RSwSZXR+Z8/F0JxIjMqsviHeXbRjFemlL8Fvt+cakx40D59Ks4+n7 zeJsq04fCeJu9dFQIRn07z7iIdLX4rl/PKp83kmRsp4q07uTWuiDQbtQD+oteCSetQtPWBIexCs m0jdQ8hkcbPtONFXBQVT76PL4h0xgcmWD5PYDgjSPZH2ALX7q3rs+IxzaU2xpQkmbo10TJzpp98 +5CD545p+qTwf0CjyKYzC69d786pnLIOPkXi/0GxSiQJIfY9SmFQBh/1Bf9zRn9D13dSfhPXsC+ MZZgZaZ+R05Bf3rMqu22ciAtjR/Bc/IP9jjajyY90ADjQre0KBk+ELRFR+Lr31i6vKAdKoNNyJq f3/OUYqNs8dHQIUOaTJ9rRiRBuxpEZnc75oA58Y/y0m4jnLG+EBk0M8XnLMG190IbjXHBag1bCM /Y1D42C13TfvQ3o/o2w== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDEyNCBTYWx0ZWRfX/KFhvkyS2wsv C8fdHv/1zTQardpbM+KaXaIm5bjoTaYyy+9cUSM7N7wsg/mZpwisB2oHDZB0z9YLTwr7KrY/WVM YpvBZj4IVtOl04hdao/k3eKVEAdFzEs= X-Authority-Analysis: v=2.4 cv=Cv2PtH4D c=1 sm=1 tr=0 ts=6a6a1ba6 cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=TQlc2wDWUpY00yvoUuwA:9 a=QEXdDO2ut3YA:10 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-ORIG-GUID: l2demgNfyONpUABMzT0Uq7aAClXFEaDs X-Proofpoint-GUID: l2demgNfyONpUABMzT0Uq7aAClXFEaDs X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_06,2026-07-29_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 bulkscore=0 spamscore=0 priorityscore=1501 impostorscore=0 adultscore=0 clxscore=1015 suspectscore=0 phishscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607290124 Currently, in ath12k_wmi_mac_phy_caps_parse(), kzalloc() sizes the mac_phy_caps buffer as tot_phy_id * len, where len is clamped to min(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). The subsequent memcpy() destination advances by sizeof(full struct) per slot via C pointer arithmetic, not by the clamped len. When firmware sends short TLVs, the second and later slots are written past the end of the allocation. The reader in ath12k_pull_mac_phy_cap_svc_ready_ext() also indexes the buffer with full-struct pointer arithmetic, so the allocation must match that stride. Fix by using kzalloc_objs(), which derives the element size from the pointer type, making allocation size and pointer stride provably consistent regardless of what len the firmware provides. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath12k/wmi.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c index 672eae237ac6..d466baf5e90a 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -4765,14 +4765,16 @@ static int ath12k_wmi_mac_phy_caps_parse(struct ath12k_base *soc, if (svc_rdy_ext->n_mac_phy_caps >= svc_rdy_ext->tot_phy_id) return -ENOBUFS; - len = min_t(u16, len, sizeof(struct ath12k_wmi_mac_phy_caps_params)); if (!svc_rdy_ext->n_mac_phy_caps) { - svc_rdy_ext->mac_phy_caps = kzalloc((svc_rdy_ext->tot_phy_id) * len, - GFP_ATOMIC); + svc_rdy_ext->mac_phy_caps = + kzalloc_objs(*svc_rdy_ext->mac_phy_caps, + svc_rdy_ext->tot_phy_id, + GFP_ATOMIC); if (!svc_rdy_ext->mac_phy_caps) return -ENOMEM; } + len = min_t(u16, len, sizeof(struct ath12k_wmi_mac_phy_caps_params)); memcpy(svc_rdy_ext->mac_phy_caps + svc_rdy_ext->n_mac_phy_caps, ptr, len); svc_rdy_ext->n_mac_phy_caps++; return 0; -- 2.43.0