From: Mikhail Limarenko freq_to_idx() currently returns a monotonic index even when the frequency was never matched. In chan info paths this can lead to out-of-bounds survey indexing for unexpected frequency events. Return -EINVAL on no match and make callers reject negative indexes. Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64 Signed-off-by: Mikhail Limarenko --- drivers/net/wireless/ath/ath12k/wmi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c index e647b84..422e3f8 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -6520,7 +6520,7 @@ static int freq_to_idx(struct ath12k *ar, int freq) if (!sband) continue; - for (ch = 0; ch < sband->n_channels; ch++, idx++) { + for (ch = 0; ch < sband->n_channels; ch++) { if (sband->channels[ch].center_freq < KHZ_TO_MHZ(ar->freq_range.start_freq) || sband->channels[ch].center_freq > @@ -6528,12 +6528,13 @@ static int freq_to_idx(struct ath12k *ar, int freq) continue; if (sband->channels[ch].center_freq == freq) - goto exit; + return idx; + + idx++; } } -exit: - return idx; + return -EINVAL; } static int ath12k_pull_chan_info_ev(struct ath12k_base *ab, struct sk_buff *skb, @@ -7475,7 +7476,7 @@ static void ath12k_chan_info_event(struct ath12k_base *ab, struct sk_buff *skb) } idx = freq_to_idx(ar, le32_to_cpu(ch_info_ev.freq)); - if (idx >= ARRAY_SIZE(ar->survey)) { + if (idx < 0 || idx >= ARRAY_SIZE(ar->survey)) { ath12k_warn(ab, "chan info: invalid frequency %d (idx %d out of bounds)\n", ch_info_ev.freq, idx); goto exit; @@ -7550,7 +7551,7 @@ ath12k_pdev_bss_chan_info_event(struct ath12k_base *ab, struct sk_buff *skb) spin_lock_bh(&ar->data_lock); idx = freq_to_idx(ar, le32_to_cpu(bss_ch_info_ev.freq)); - if (idx >= ARRAY_SIZE(ar->survey)) { + if (idx < 0 || idx >= ARRAY_SIZE(ar->survey)) { ath12k_warn(ab, "bss chan info: invalid frequency %d (idx %d out of bounds)\n", bss_ch_info_ev.freq, idx); goto exit; -- 2.47.3