In ath12k_wifi7_dp_rx_process(), hw_link_id is extracted from hardware/firmware descriptor and directly used here (and also stored in rxcb->hw_link_id which is used later in other functions) to index ag->hw_links. ag->hw_links is an array with size ATH12K_GROUP_MAX_RADIO, unverified hw_link_id could lead to out-of-bounds access. Add the boundary check before using it. If the check fails, continue to process next descriptor. The same applies to ath12k_wifi7_dp_rx_process_err(), fix it as well. This is found during code review. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0.c2-00068-QCACOLSWPL_V1_TO_SILICONZ-1 Signed-off-by: Baochen Qiang --- drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c index a32c804403e8..c8e590e5e250 100644 --- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c @@ -705,13 +705,22 @@ int ath12k_wifi7_dp_rx_process(struct ath12k_dp *dp, int ring_id, cookie = le32_get_bits(desc->buf_addr_info.info1, BUFFER_ADDR_INFO1_SW_COOKIE); - hw_link_id = le32_get_bits(desc->info0, - HAL_REO_DEST_RING_INFO0_SRC_LINK_ID); - desc_va = ((u64)le32_to_cpu(desc->buf_va_hi) << 32 | le32_to_cpu(desc->buf_va_lo)); desc_info = (struct ath12k_rx_desc_info *)((unsigned long)desc_va); + hw_link_id = le32_get_bits(desc->info0, + HAL_REO_DEST_RING_INFO0_SRC_LINK_ID); + if (unlikely(hw_link_id >= ATH12K_GROUP_MAX_RADIO)) { + if (desc_info && desc_info->skb) { + dev_kfree_skb_any(desc_info->skb); + desc_info->skb = NULL; + } + + ath12k_warn(ab, "invalid HW link id %u\n", hw_link_id); + continue; + } + device_id = hw_links[hw_link_id].device_id; partner_dp = ath12k_dp_hw_grp_to_dp(dp_hw_grp, device_id); if (unlikely(!partner_dp)) { @@ -1469,6 +1478,11 @@ int ath12k_wifi7_dp_rx_process_err(struct ath12k_dp *dp, struct napi_struct *nap hw_link_id = le32_get_bits(reo_desc->info0, HAL_REO_DEST_RING_INFO0_SRC_LINK_ID); + if (unlikely(hw_link_id >= ATH12K_GROUP_MAX_RADIO)) { + ath12k_warn(ab, "invalid HW link id %u\n", hw_link_id); + continue; + } + device_id = hw_links[hw_link_id].device_id; partner_dp = ath12k_dp_hw_grp_to_dp(dp_hw_grp, device_id); -- 2.25.1