From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D59BC2E6CA6 for ; Mon, 1 Jun 2026 16:09:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780330162; cv=none; b=nYH+8dQUnzVY6iDuNWvtfJUTDV9kVkroKe1/hfMKSfU1emCyz7Nkk0bI8aKZG8M0CREEAGl+B7grpueai8tUtf9341fG6BWbEyzo+KUHa3iXRMYSB8Igp4gUn3u1gyOUP9nafQgtEjywUM62+OIYYXV/8HhbS2zczndPHAE8jG0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780330162; c=relaxed/simple; bh=bGnsh7o7wBgoQXtnQxFsz4RoWlKXrVOgieSjjFPrIQY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=mb740hvIEcpoCqIbxUaSxun6GdpjL/NqiIaSLBh8soZz8jbhJ7sR7YzqH3etoul45Os0uBb7qUoWuVUt8Tg6gO/GGtDrsItlOah2RkpX9HQafnE3U8X1Icq1dw1Jp47uZ8ir+4EExeMhTjevbH0TNHzea4gjjLGN/p+p3dXtgwU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=HEAx/FOL; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=X6G6Bf42; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="HEAx/FOL"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="X6G6Bf42" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 651FEJHS145128 for ; Mon, 1 Jun 2026 16:09:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= r85YYvRXUgeOdHZjMqt3osRrQ3RltXHNQbceWHFhVYg=; b=HEAx/FOLtHxgirbF 1kbN8Aa2p+KUzYqfOBHMc/lKglW1x2tkH77zMxhRPuI+gArY79zFQ0QqTa3iC8CA Y9lMJFkrsRkTRGUI+CuRGsEXQ2IZDi41sBhBid5PaJwKno4Qq3c0qg/KawMX61Ei P8Svvk3Fg9Nj6ciokF34prsgNqCZPs1VYYFi2D4aDnQVsi2b38h1qRtoQAF7gttj GguoBOk9qcKKWD7gDjJnh1Z8upZiR3PeXVruChS2LWyzLtgWyUK5TmeUl/AzHx1s G5X1ODB2yeQuf24UsDhoIHQg8kKEh9UUm+g942EOKgsxz6fUOS3N5L08Kf6zVjzs x2ltwg== Received: from mail-dy1-f197.google.com (mail-dy1-f197.google.com [74.125.82.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4eh6ststmn-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 01 Jun 2026 16:09:19 +0000 (GMT) Received: by mail-dy1-f197.google.com with SMTP id 5a478bee46e88-304d0d0b28eso2463732eec.0 for ; Mon, 01 Jun 2026 09:09:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1780330158; x=1780934958; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=r85YYvRXUgeOdHZjMqt3osRrQ3RltXHNQbceWHFhVYg=; b=X6G6Bf42HOFIHISD3gQDqw+PH1pqKsx1Cpq6qk531xwLEuB3Jq9076Ay580dSH32r4 fV83iBx7j2ih9yvSndT5Mh2fmpK4NKfq5xiA4L66OT9AEDb/3dhJiKdJGEq05fOtztWP p+HEhGrwLMoioRDUtokzT04EzkahAT2LqFQ+YGbO9Di21aZeYl4CeQSZ+BAQpldr6tjU mFLwMURnEnRrChrAoN6B+eUYMgGrNUm8/GvbHPeAFDf40l8vWTxD2BiSVMLGaN+3+6zE 6D9JvSTCcMToHVyU9IQ+9zuT3j9mRdJwJXWtDAkQVhqBU0QKCFP8ZqQ9KyI8aH3vfN9A gu3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780330158; x=1780934958; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=r85YYvRXUgeOdHZjMqt3osRrQ3RltXHNQbceWHFhVYg=; b=GQfgKxAaP4CbTPDROsFr4SqWwfudo7OBCKmnGUWX45RZuAmiI1mfBE/0dT55X0hlC1 nwCnCaD2xxu1dhhZAdHgBItMxeDELa8ElSEr4X5+iJ6305uB2wcS/awR04BZZd7cwI6o 4sykTB1WTrXBguP+GamhcLomSwIBoR30vgyFsOtBkvlE0wl7hubMVU0Anq6ceS5X2BQc 28Luia1Kh0BF3GJ+kAUsJwmXst9pnJWsHtG/SOEW+qyAAPtyc0IHC9LeSYCm3xzDPK2e 9l8nojP6eq1gvKJh5GmRG/XZG2moHpb//f2D27O634k9buMWmMtbBGWJcgqd2FCpHjPd K1Cg== X-Forwarded-Encrypted: i=1; AFNElJ+hlK4CjevCOMIpsHIPXnEvP4sFcYgK4krhSTkLaDyBUKHEKZMw1ehO5PPb/EBNn/ULsSvnxIiKQR95vA0=@vger.kernel.org X-Gm-Message-State: AOJu0YwS2qaWYU0kL7z82i8g9sUnAxWdA6Yax+p9+HA2CCmVumlbvi+v 8S1MnduiTgVty+ZnohQ8d6ivsVUXIyZKfe0bGUXimknUhUUiBCpK9800naeOfH4wTnxCbW116cy +YR98RwJcmIPW0jj0fayuyuH7iY/B0I873VPVWAQSo8BppomToPvHzlyjl/QzWclNclI= X-Gm-Gg: Acq92OGz+pp0DW+EpXGMi2nd0Eo+WDKprlQl3tFefCPxjBPnfxd4d0zfTKZmMxM1cbd HCmsE2FE1jo6hcIIXo6T2auKj2lsZquyFCh8wPVBEVYBHHBIZAGxtph97WwHhch1FLYEyLzNSyF k419JBWATvYxSkkBu6JB7sPjoWcyr8ugKm9mKyCHwe4ex9HGFkItnqloi33fs+JvLXT2/uBI/XL A8LBivwaefQSRWCoTEhau5p+pIik/B8kLtjJ/GJwj1zzTOpLjzRm2VI1wKZtLkqQI6RTtaMWyX+ +S+Zkm2XsRK/BB27OXuLUI2MeJLVgycznoZaoaIaT/Rw/tL+H1BnPL/iB052noBynOWgLR8wZkn bo3p4lomDz25iHuAObfQHHmuEBcdfTtc6+jzo7l5afp1wFvzXqXaJ4C4HfHQ56IBIxhrQ1ENw1n fVGStI2CxzQ7Jbc+ni X-Received: by 2002:a05:7301:6a18:b0:2ed:e15:c926 with SMTP id 5a478bee46e88-304fa69c7ffmr5559227eec.34.1780330158266; Mon, 01 Jun 2026 09:09:18 -0700 (PDT) X-Received: by 2002:a05:7301:6a18:b0:2ed:e15:c926 with SMTP id 5a478bee46e88-304fa69c7ffmr5559188eec.34.1780330157690; Mon, 01 Jun 2026 09:09:17 -0700 (PDT) Received: from [10.227.110.203] (i-global254.qualcomm.com. [199.106.103.254]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-304ed5f6426sm9016059eec.31.2026.06.01.09.09.16 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 01 Jun 2026 09:09:17 -0700 (PDT) Message-ID: <84b140b1-1060-47ad-ac3f-ecaea7f97d40@oss.qualcomm.com> Date: Mon, 1 Jun 2026 09:09:16 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH ath-next 1/2] wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi To: Baochen Qiang , Miaoqing Pan , jjohnson@kernel.org Cc: ath11k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260512022351.2033155-1-miaoqing.pan@oss.qualcomm.com> <20260512022351.2033155-2-miaoqing.pan@oss.qualcomm.com> From: Jeff Johnson Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjAxMDE2MCBTYWx0ZWRfX43zXda32ZcUW FJy859joQC3PGWQSaHD9fV8NROcYL2DyBTg+GMfKbKvkmrAWtqVdM+CCfsapTU+VDcDbCLUIESd yZ7bC0jp8kTJ04C5cdrmLxdhQ8R/t1xu+eD5ltKdf1glXTTZTmFkTk7B+A3aD9oZsf1TVGPisR7 9nm8zzou5zK+sRu//t0QbVFQR6HYQtMFQjER97SFtY21yMu/EFJu/m2Uu2EUcTU52VhiCB8LPlb wz+80ChGNB9Fl4xPv014kdYE7m9ChYCYpah5h+9aC6xL73/ubfAsnwUdS/o5eD5LBO3eyoTRr5x 3DL08rDLXSjXr+7rO4y0hqRS4bl/O7JITn13l2VsSRp9NeyD7iUA8ggD4XN6UDzHlfKsGvU4uay 5i75M1r0R5WpyfOhb3Ti1pw28qY9Gx3h7ynrCEUNec2h5Ey4pbJpcTvOK8I793NKkjfSU9yKl2F nSa6YOBXT7Au7z/cdCw== X-Proofpoint-ORIG-GUID: zwgwec79U-j6ubQqNVZ_sc5d_KUNxgdE X-Authority-Analysis: v=2.4 cv=HrNG3UTS c=1 sm=1 tr=0 ts=6a1daeaf cx=c_pps a=Uww141gWH0fZj/3QKPojxA==:117 a=JYp8KDb2vCoCEuGobkYCKw==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=PbU15OE6me5PO1c1xRkA:9 a=QEXdDO2ut3YA:10 a=PxkB5W3o20Ba91AHUih5:22 X-Proofpoint-GUID: zwgwec79U-j6ubQqNVZ_sc5d_KUNxgdE X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-01_04,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 bulkscore=0 clxscore=1015 impostorscore=0 adultscore=0 malwarescore=0 phishscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606010160 On 5/31/2026 8:47 PM, Baochen Qiang wrote: > > > On 5/12/2026 10:23 AM, Miaoqing Pan wrote: >> In certain cases, hardware might provide packets with a >> length greater than the maximum native Wi-Fi header length. >> This can lead to accessing and modifying fields in the header >> within the ath11k_dp_rx_h_undecap_nwifi() function for the >> DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and >> potentially result in invalid data access and memory corruption. >> >> Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k] >> Call trace: >> ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k] >> ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k] >> ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k] >> ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k] >> ath11k_dp_service_srng+0x2e0/0x348 [ath11k] >> >> Add a sanity check before processing the SKB to prevent invalid >> data access in the undecap native Wi-Fi function for the >> DP_RX_DECAP_TYPE_NATIVE_WIFI decap type. >> >> This adapted from the discussion/patch of the ath12k driver [1]. >> >> Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 >> >> Link: https://lore.kernel.org/linux-wireless/20250211090302.4105141-1-tamizh.raja@oss.qualcomm.com/ # [1] >> Signed-off-by: Miaoqing Pan >> --- >> drivers/net/wireless/ath/ath11k/dp_rx.c | 50 +++++++++++++++++++++++-- >> 1 file changed, 47 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c >> index fe79109adc70..fbe2061a544d 100644 >> --- a/drivers/net/wireless/ath/ath11k/dp_rx.c >> +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c >> @@ -2502,6 +2502,29 @@ static void ath11k_dp_rx_deliver_msdu(struct ath11k *ar, struct napi_struct *nap >> ieee80211_rx_napi(ar->hw, pubsta, msdu, napi); >> } >> >> +static bool ath11k_dp_rx_check_nwifi_hdr_len_valid(struct ath11k_base *ab, >> + struct hal_rx_desc *rx_desc, >> + struct sk_buff *msdu) >> +{ >> + struct ieee80211_hdr *hdr; >> + u8 decap_type; >> + u32 hdr_len; >> + >> + decap_type = ath11k_dp_rx_h_msdu_start_decap_type(ab, rx_desc); >> + if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI) >> + return true; >> + >> + hdr = (struct ieee80211_hdr *)msdu->data; >> + hdr_len = ieee80211_hdrlen(hdr->frame_control); >> + >> + if ((likely(hdr_len <= DP_MAX_NWIFI_HDR_LEN))) > > nit: Double parentheses on likely() I've fixed this in the 'pending' branch: https://git.kernel.org/pub/scm/linux/kernel/git/ath/ath.git/commit/?h=pending&id=99f35f3f082fca14fc3324e48abd805871d39c69