From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15320386428 for ; Fri, 3 Jul 2026 06:45:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783061130; cv=none; b=nfNqq7GDP1qmavxxfvFciYROt3CX6oVSuBXAtYnvTo2mBeegEmIkYBNmUBguOChYz5PWP2LDQUi6rQXEtLbAhQyV4LuFDKzF7bzzoQfMeln8gr1HaxqcNNlMI74Rq41f1bf7I8u6ntmxXgY+UmVmQdQ691ONpjqfF/hTDwbyco0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783061130; c=relaxed/simple; bh=z4lCII1ZehUTz9Sz3H0Z4D5t89Ta0fqSUqyBnBq0R54=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=XB12aG/S6iiSnBoWoHOp7atdtV1FCZMteMZ86FgjBeCHEEHVu6uvyPDWRsmIlNjX+FRMiJD9VnXIdqCWVBtqtwuQYLY7VWPhKu9/jjUCYZKZoex8cKTSXwKInhGXkzEM1RnrlapcqCozW+YmgjVNzR/suUoF/BdY959hjNmgXVY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=hiSvtWqm; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=LbPy4i11; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="hiSvtWqm"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="LbPy4i11" Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6635rpn83088123 for ; Fri, 3 Jul 2026 06:45:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= kfCsJor6zr9JsHaxgfb1o+ZCD1IlPkC0zKCAWBS/gS0=; b=hiSvtWqmwcoBj3sD tQKWAXmYbaBpniUdOco+jxUBFPFfnfA1KU2X1Gj+q2byMnkhAQmjPGABzhlMMB0U 1iiqZndY8/9DJECEnS2XQprlGyO5NiWAS59woH22eEsD33aw+RL3njkNRlDI15o1 JBbFoO6aK18sC43z/EuypdbGTH3QUeT+7LCFxLTzDsyxGzZSTZv4juAeqGEVqObH iyXX+56/D88FqYqg1tAgW/KzOY0V7W1MXPKozIleggk0vp16UF0F42srXGTFf02q jjYvRK35i+mqueQN7Rj9zDal/GEeJdD135GOUI9EeCDpA1QYwsZE56W2csLkggAo sCWJgg== Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4f5s253p2f-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 03 Jul 2026 06:45:25 +0000 (GMT) Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-c860544c077so719142a12.3 for ; Thu, 02 Jul 2026 23:45:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783061125; x=1783665925; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=kfCsJor6zr9JsHaxgfb1o+ZCD1IlPkC0zKCAWBS/gS0=; b=LbPy4i11EiGOBd7uQ59Je/9zeAaq8sJPy8Jhg4U8SZoPg8CsctfT1I0U/FOIXfvwzh tm1xP/00k0KAUu8PeuZo+pn77j46YD46kVwp8VcGxxhGg+Fr8y07MkWrqF+fma6GLy31 PfmDx1CsLUbKs18kW5eSkk9yGTX5IkvwAbIMuwhF6O1R0P5WO1/fhArLnbuSey+j9QI2 yBqhHERWfDj4svNdYpEchKgTNffKLovHoLBf2zgl76rSiTMnZBH3RqN+t+fAAuGTA9Vt gXIGczkSjjbk5xRTfy8vdBLQu93UUUGnbD7Fvi7NocG9JaSiTjDYmFmtGZqilrtXR4ii +YfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783061125; x=1783665925; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kfCsJor6zr9JsHaxgfb1o+ZCD1IlPkC0zKCAWBS/gS0=; b=Mjkqhwh/xFJhkANNpSM+zoRADGEshdEUXdSatZlqjMbWp+aP9OQ4/vS6MW/tzIufXv ON/nYczAjFJwjTJWfPcZiyD6kPgRZe5a65TO2uNJWRwUL+MMzfKDQRKikj/0Z/RMtDrl +7zRQnS6EXdwa25ODdkSgQ534rXZXjRw3FlHg/5TKmSechgXbw+KhX7rYjZaxvJj4xcl CDKXt4xJAA2aFkkyB0klcxlX17JR2/OiFlvsfW5GpcEu5xLYh8XXlPK9q+OObQVtWVlW lGvU9e7dJWtp+K+LCEzisIHjVC0/Nq5eA1Z08OLVuVNWttf+fIiC/zAHWvjXmCxNdUqH +VZg== X-Forwarded-Encrypted: i=1; AFNElJ/Yze/27NkdK7sK+yF9GnZ5+Zs7oGfcNEuKKL6qaO4XmY5S7rbQ8qs2bDGPvPjRzQb1vu3ZDV7jIePou/s=@vger.kernel.org X-Gm-Message-State: AOJu0Yx3OrI4TsXrPPlnd3WBJKUqxYPw4SGE68na9lTQF/DmxxP2E3PC khDhBczEUV2EV4obWwg8Fnfx8Rc8v+JtWdsPqojs7JeOhE+YjTGEgaB0dShP5+hPo1sA1toVYgj EsY7jbThUGfZJsgGZy2CU0+MJ8y+eelkJk1V5loK6uGyneu2wKKKWbPfPDqFxebmiQJc= X-Gm-Gg: AfdE7cmZxWSumfWS52jbFmGizF2g2WBR9u6X+t553biYmhD1wCMRHDelK8du3GYvK19 PDLl9xl3KNxoTPVChM59lUFDezXxoaLbyp7DPsi0SYJ2h7ulJXCHDI5zh+kOwz+UJpIel4+76Y0 hD5YSMVByRQ+4Cd6x2BpSQZwGjBW9wGiQsB9WWDQ2PUMovDXOXmsfJYm2nH+9zjCLh7RNAwMtxJ +nyNi/s/AMfdkhpERI++bATAGVqOeBvP144AVBG37/nxmbgvqDanQrGIRzH63Hk4n+kaTTPWCVv byzwJhTzIWghtgrKba5qlsC+JX7h3zU3LjL6rT8NhbTFrnThEqlresPCM4QBvPigKMfn5hddE4a 19HQcIp/np4glYD57rAgLraoE5je/naxmUkywmiPLM5W/oRIS9wd1dk2ZaUTzLh+x2M5DgI1BiO 52BKLBk07K X-Received: by 2002:a05:6a20:3ca7:b0:3bf:6c08:2843 with SMTP id adf61e73a8af0-3bff42daee4mr11446771637.50.1783061125021; Thu, 02 Jul 2026 23:45:25 -0700 (PDT) X-Received: by 2002:a05:6a20:3ca7:b0:3bf:6c08:2843 with SMTP id adf61e73a8af0-3bff42daee4mr11446741637.50.1783061124596; Thu, 02 Jul 2026 23:45:24 -0700 (PDT) Received: from [10.133.33.211] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c9e8eb0efc8sm2367706a12.5.2026.07.02.23.45.22 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 02 Jul 2026 23:45:24 -0700 (PDT) Message-ID: Date: Fri, 3 Jul 2026 14:45:20 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() To: Dmitry Morgun , Jeff Johnson Cc: linux-wireless@vger.kernel.org, ath11k@lists.infradead.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, stable@vger.kernel.org References: <20260530114252.42615-1-d.morgun@ispras.ru> From: Baochen Qiang Content-Language: en-US In-Reply-To: <20260530114252.42615-1-d.morgun@ispras.ru> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Authority-Analysis: v=2.4 cv=U7uiy+ru c=1 sm=1 tr=0 ts=6a475a85 cx=c_pps a=rz3CxIlbcmazkYymdCej/Q==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=rJkE3RaqiGZ5pbrm-msn:22 a=HH5vDtPzAAAA:8 a=xjQjg--fAAAA:8 a=EUspDBNiAAAA:8 a=zEb-VJRgp1rxa82pEt8A:9 a=QEXdDO2ut3YA:10 a=zZCYzV9kfG8A:10 a=bFCP_H2QrGi7Okbo017w:22 a=QM_-zKB-Ew0MsOlNKMB5:22 a=L4vkcYpMSA5nFlNZ2tk3:22 X-Proofpoint-ORIG-GUID: X-tfANBn4TYWWDtRRHHFbWN64-6iLGIc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAzMDA2MiBTYWx0ZWRfX4YMOdHW24ac4 G3AqNj4eRtEvNbHtP4hCd8sNSw5ffndluGMJYUS4+QSeksAFra8LF+PJNkZt/KX7p652chw5FLs 48N3i4z/gpgYOKwAx/dwh4PvRPf/xN8a/fB2QV4IcxJcqwy7TZFBL7On4eICJX3sOs9BwsufsxD Aeq5y33bNPrCeC7VHTqRak4I/TvRY6en1h4FQK/acgV2gTwFuRnkCLO1fpmpKp8PQPtzigQvAXU 8VWoy/CM30/ZkMPfhDB3Kg+uWI76aCAiFR7fEi5n/Okd70DcUylTPZ4lCguLVt2CdCe6AAyUzLt y2EEDpbjnFEQc2ienhPDcIEI0mFhx8Hdyy8ZRk9yurLncaZRgJL/zNrvoA6VNZV5fJESwiRIWWI APurVB5pgbUkLshsBxhcR6GXnan7+QuyLW4lcQC1BHKxBim9c6JT9H5s0oWasvyDie5c9ZcCDAh Ez2invmyb677TXmuQYQ== X-Proofpoint-GUID: X-tfANBn4TYWWDtRRHHFbWN64-6iLGIc X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAzMDA2MiBTYWx0ZWRfX+qEPSZSS8aHK VKjMLj/Ml1rbBCy4vk2LJHI64YhRqmAt/lBiAw1MaXurqCZ7iRm4y27ympx3oT8+MaLobX0z+9J kAeS6I/wM8JNo4g8r3PD62leFqwYLG4= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-03_02,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 bulkscore=0 suspectscore=0 priorityscore=1501 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607030062 On 5/30/2026 7:42 PM, Dmitry Morgun wrote: > When the first entry in msdu_details has a zero buffer address, > the code accesses msdu_details[i - 1] with i == 0, causing a > buffer underflow. > > Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding > a separate check for i == 0 before the main condition to prevent > the out-of-bounds access. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") > Signed-off-by: Dmitry Morgun Reviewed-by: Baochen Qiang