From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
To: jjohnson@kernel.org
Cc: ath12k@lists.infradead.org, linux-wireless@vger.kernel.org,
linux-kernel@vger.kernel.org,
Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Subject: [PATCH] wifi: ath12k: fix wrong register read for RU start index of 80_3 segment
Date: Fri, 30 Oct 2026 10:09:06 +0100 [thread overview]
Message-ID: <20261030090906.298234-1-jtornosm@redhat.com> (raw)
The RU start index for the fourth 80 MHz segment (80_3) is read from
rx_usr_info->info2 instead of rx_usr_info->info3. The bitmask used
(HAL_RX_USR_INFO3_RU_START_IDX_80_3) is correct for info3, so applying
it to info2 extracts garbage bits, producing an out-of-range shift
exponent that triggers a UBSAN splat:
UBSAN: shift-out-of-bounds in drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c:302:22
shift exponent 284 is too large for 64-bit type 'long long unsigned int'
Call Trace:
ath12k_wifi7_dp_mon_hal_rx_parse_user_info.cold+0x3a/0xef7 [ath12k_wifi7]
ath12k_wifi7_dp_mon_rx_parse_status_tlv+0x621/0x990 [ath12k_wifi7]
ath12k_wifi7_dp_mon_parse_rx_dest+0xa9/0x2b0 [ath12k_wifi7]
ath12k_wifi7_dp_mon_srng_process+0x34f/0x560 [ath12k_wifi7]
ath12k_wifi7_dp_mon_process_ring+0x205/0x270 [ath12k_wifi7]
ath12k_wifi7_dp_service_srng+0x1b4/0x5e0 [ath12k_wifi7]
ath12k_pci_ext_grp_napi_poll+0x43/0x100 [ath12k]
Read from the suitable info (in this case info3) like the other three
segments do.
Fixes: 5db19c488413 ("wifi: ath12k: Move MU user processing to Wi-Fi 7 module")
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
---
drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c
index 1e29c13ad66d..0e69d9fe138b 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c
@@ -293,7 +293,7 @@ ath12k_wifi7_dp_mon_hal_rx_parse_user_info(const struct hal_receive_user_info *r
}
ru_type_80_3 = le32_get_bits(rx_usr_info->info2, HAL_RX_USR_INFO2_RU_TYPE_80_3);
- ru_start_index_80_3 = le32_get_bits(rx_usr_info->info2,
+ ru_start_index_80_3 = le32_get_bits(rx_usr_info->info3,
HAL_RX_USR_INFO3_RU_START_IDX_80_3);
if (ru_type_80_3 != HAL_EHT_RU_NONE) {
ru_size += ru_type_80_3;
--
2.56.0
next reply other threads:[~2026-10-30 9:09 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-30 9:09 Jose Ignacio Tornos Martinez [this message]
2026-10-30 9:41 ` Tamizh Raja
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261030090906.298234-1-jtornosm@redhat.com \
--to=jtornosm@redhat.com \
--cc=ath12k@lists.infradead.org \
--cc=jjohnson@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®