From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C377AB640 for ; Mon, 1 Jun 2026 03:47:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780285644; cv=none; b=O9Vqmyr/lB+ihGSTe0L1j3RR63b9OJuaTJAZa32PnH11M1Qd+/IMZx3fnepM+xYl++MRX4pq5lSiJKOJMw/4/soLU86DdmtdxwRtS8h4OuoJEGfXdNnlLHyj7E38RIMCeEpolJsaIJxClb+/8i2IfSoZj2q/ZpUg5tfE4s0YJOs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780285644; c=relaxed/simple; bh=l2FLpPWqcyP+8WWVKleL7AInZCZdnX/IspnCXVfkSJo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=WNiBG8QfJQUGhbzRnzhIsLdANfEZtwcf+pWfmNiWDeiDyeNJ9pxSDAEmK4tA+oHDmlOoLOLuSHM7/eNdQh3LyRu/LzuODCc1czhx5zCo5HK5FeT62CC29WM2jaiNdpk55wH74J/NHTboy0Uk0H80+Q4i2lFI5ebnZkkioAe/I54= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Vnc3x50D; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=TEFelau3; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Vnc3x50D"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="TEFelau3" Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64VLKAKU1785919 for ; Mon, 1 Jun 2026 03:47:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= kLQaNwgFzPvUJk0AnhaNubQuSeLF1I/jBvaeiZsg7YM=; b=Vnc3x50DzjBsGBs2 RXwMgtUT9dQkze11gNokbEkHuvDNIRKXN1JcJZ9ohnUxqw9ubD9aSMkQrj3BaWyp pPFrHa8bPuFeHHU9UH+0QNFbxwlrh9lLkKDrEYOw4NMYiqatB5hHqEFoI85FV6ng PdwIZrtmah7xH1+CMddOu31LVh7Kst7KWEDwUXSCLItRpqP4WKlsIvYV0mhgUFwJ P8IkIVh83C5jOHhcwIygaKb5tIaz5UFRj9g/OP7tPicW1tcLC1SDVM++jQpd73fp tFSIMMHt7upuQ2zD4xGd2hIRfwOHOaEBE9igyCJ27q1Umnuj+xwlLznI7wH2YNW8 tBzBlg== Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4efs66w9v5-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 01 Jun 2026 03:47:23 +0000 (GMT) Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-8421f5d76aaso1321180b3a.2 for ; Sun, 31 May 2026 20:47:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1780285642; x=1780890442; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=kLQaNwgFzPvUJk0AnhaNubQuSeLF1I/jBvaeiZsg7YM=; b=TEFelau3ib2+48kR6gHESr0Wd0ObNoQRXaxwNF3kXai5/Gb97f7HLGOkgfuqb0UuTG XJl/KQo+YY65dGa1Evt9o6tVnPMbHJUUTFW/GEqD6Ypzhitc3KmI3yfH5e9a61Q+Q4Ey 5huZAxPBKCBL2KhYmkeH1GO5laV82pZFjYV0ovXyeEgvhN2An7gr0M5Bb+pEJTykOBE5 6lq9UhM+Fr3Q+PBa9n37k9tdrP0MyHL+hLBViLs4o0sorqNh0Yz2pEvxQWehXC7k0fVb ZDl5rEviP2BKM/TrQX05IjZssIHcH/jzUn5e4cS7hQ7k5g7RR/sH5VOd8jtj+DN8dkoO iDFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780285642; x=1780890442; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=kLQaNwgFzPvUJk0AnhaNubQuSeLF1I/jBvaeiZsg7YM=; b=YzYy05HeeIJZBU1qo6In7oDxIQzuAtL66DP9WYXvl17M0fFUIaF0xdT4cINx3SJ0jo JXKBEpbTjnkf+eqePqQCK3CkKzPqmO2JjTd/E3sA52k/FHYeQvf7iEvWU1jBGLUxEio6 r9z3ufbTEQpYGdODS7e21CxAPDZEMcCeIn4+aPd93nIfDRB5b+eu04f3LiyV6F3u/Mtq BUJ5cpOCtClw8ZwflaVECBjSCD4ZMb4liHm8/KUarIhsNPWTyQh1j0kYLiSNjjFTAHCH Tu/R1Wj9dpx17b6Us5gT368ReyPi+JjjEBBfLtYDCpaLjXZYdrSJqfK5ibwHJy7WdAlh 0LNw== X-Forwarded-Encrypted: i=1; AFNElJ+9B4ABQAI2+6PTnN7q+nYuzOoR0ICLfV1h10+0k10NGMMB54P2l+9hqY3nsLVULLxgG0fzkAh1vK25fJA=@vger.kernel.org X-Gm-Message-State: AOJu0YyC866iM/jK0YJY0VpbkkFejlVsUSFza4i5ar39YwbsGCgP+2XQ 3IvusK8EUl6WSRjAMghv4g0cyiFAZnR65oMjRskZtdKt83xsbPCkOVRe+RbwqOopTpLPCAx5yx1 wSUU4tIH7weuq8rrVyV49JGgIGiKnwBfGIr9vaC3cHUtYJMmpZW/w1N65q7ZCGlGaSSc= X-Gm-Gg: Acq92OHtpe1weteV9N8lGNtKv3SWsVl3xqrZFFFOUK4ls+PlA+ehHf+9guIPDJXRe3Q rO3q7bsI2bk6+KuzJX/McEAcWFWyRbsVS34T9Nnw9HzsUMnWi0ekgHQ2tGsdeyRdpvfO9MNw1On OgwwgLrFXjgsg1C6uZ53ojmIChrLoiAW45jYKkE6km4swRJ3BBW8CI7bpwxxcXVOQIxDuCQ8pBJ 37RgHDag6B2Jk3g7d9Dqk/0vWHQFmi+wwaF+Bv/1XrjyWOJxZhI8RSLpLJn2WsylqC6NXNTnQY1 1VqNrnduP9dldNnXcWCe85EjN57moXmlLEA/zkXbfXzHqZ3gbufdzzg4bMaoAwI3TXWdCHWd8yT NLL4Vkf3hD4OZ+cAt4/FBAdlzNKalqBe3FNaLsnU+1q+1zB34s76F/nobK9cc0AKtGz7p0vgj5N F3YaC6EKjI5Lk2gLU9s65PFFx7UtV9 X-Received: by 2002:a05:6a00:2188:b0:83d:b11f:7979 with SMTP id d2e1a72fcca58-842256d7549mr8612544b3a.29.1780285642371; Sun, 31 May 2026 20:47:22 -0700 (PDT) X-Received: by 2002:a05:6a00:2188:b0:83d:b11f:7979 with SMTP id d2e1a72fcca58-842256d7549mr8612495b3a.29.1780285641738; Sun, 31 May 2026 20:47:21 -0700 (PDT) Received: from [10.133.33.22] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8423bdd217csm3897340b3a.49.2026.05.31.20.47.19 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 31 May 2026 20:47:21 -0700 (PDT) Message-ID: Date: Mon, 1 Jun 2026 11:47:18 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH ath-next 1/2] wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi To: Miaoqing Pan , jjohnson@kernel.org Cc: ath11k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260512022351.2033155-1-miaoqing.pan@oss.qualcomm.com> <20260512022351.2033155-2-miaoqing.pan@oss.qualcomm.com> From: Baochen Qiang Content-Language: en-US In-Reply-To: <20260512022351.2033155-2-miaoqing.pan@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjAxMDAzNSBTYWx0ZWRfX3OYvsFnqqu0E mMNuay+pMj9qVDoKNYkeSJ/5H1G9fFgXQz3AMFNGvfWwtn2etMOCldLjbSewXX2TG4+IOZeaH6S osWBC9JRP+3EMrqc6NbHWYA8d87VMaisYSE+l0A9Xhdlwm5lKktIiGxXoMFvmummaSd8VIct7vJ I723N1bFVBpiO4ifji650i7E1rRJDOgxxT48O/gS5d7K+zvvSPaTRuNak5ipHmHmK9CrLp6lOCb fP31qKgpu5OI4ulNV4zYxMKTvb941nkIMynor77JcJhdF8RoIOuX2MC79r7Kdwall5tdeFIgQgo SWJSPqIDV91egv2VjTsPLnnvb5ofOtHB9MBGIshiz+21jnejo8/6FA0smJwvHaSN45ax+TxO8Ba RC16ssHniG/SsehBjme0niC0asGKyE/8Hx5TLzKFld6+tAA8D6fWRlGa+TjQoboxvqdSvzezSb2 Y9sME4wyeF5GBqpL5gw== X-Authority-Analysis: v=2.4 cv=X8di7mTe c=1 sm=1 tr=0 ts=6a1d00cb cx=c_pps a=rEQLjTOiSrHUhVqRoksmgQ==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=YMgV9FUhrdKAYTUUvYB2:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=EU6IV83DWVWhS13MJAEA:9 a=QEXdDO2ut3YA:10 a=2VI0MkxyNR6bbpdq8BZq:22 X-Proofpoint-ORIG-GUID: ocqVHubr7UAk2IZwMoYwCPY9psAMDEod X-Proofpoint-GUID: ocqVHubr7UAk2IZwMoYwCPY9psAMDEod X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-01_01,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 suspectscore=0 lowpriorityscore=0 phishscore=0 impostorscore=0 priorityscore=1501 bulkscore=0 adultscore=0 malwarescore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606010035 On 5/12/2026 10:23 AM, Miaoqing Pan wrote: > In certain cases, hardware might provide packets with a > length greater than the maximum native Wi-Fi header length. > This can lead to accessing and modifying fields in the header > within the ath11k_dp_rx_h_undecap_nwifi() function for the > DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and > potentially result in invalid data access and memory corruption. > > Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k] > Call trace: > ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k] > ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k] > ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k] > ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k] > ath11k_dp_service_srng+0x2e0/0x348 [ath11k] > > Add a sanity check before processing the SKB to prevent invalid > data access in the undecap native Wi-Fi function for the > DP_RX_DECAP_TYPE_NATIVE_WIFI decap type. > > This adapted from the discussion/patch of the ath12k driver [1]. > > Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 > > Link: https://lore.kernel.org/linux-wireless/20250211090302.4105141-1-tamizh.raja@oss.qualcomm.com/ # [1] > Signed-off-by: Miaoqing Pan > --- > drivers/net/wireless/ath/ath11k/dp_rx.c | 50 +++++++++++++++++++++++-- > 1 file changed, 47 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c > index fe79109adc70..fbe2061a544d 100644 > --- a/drivers/net/wireless/ath/ath11k/dp_rx.c > +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c > @@ -2502,6 +2502,29 @@ static void ath11k_dp_rx_deliver_msdu(struct ath11k *ar, struct napi_struct *nap > ieee80211_rx_napi(ar->hw, pubsta, msdu, napi); > } > > +static bool ath11k_dp_rx_check_nwifi_hdr_len_valid(struct ath11k_base *ab, > + struct hal_rx_desc *rx_desc, > + struct sk_buff *msdu) > +{ > + struct ieee80211_hdr *hdr; > + u8 decap_type; > + u32 hdr_len; > + > + decap_type = ath11k_dp_rx_h_msdu_start_decap_type(ab, rx_desc); > + if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI) > + return true; > + > + hdr = (struct ieee80211_hdr *)msdu->data; > + hdr_len = ieee80211_hdrlen(hdr->frame_control); > + > + if ((likely(hdr_len <= DP_MAX_NWIFI_HDR_LEN))) nit: Double parentheses on likely()