]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
authorDmitry Morgun <d.morgun@ispras.ru>
Sat, 30 May 2026 11:42:52 +0000 (11:42 +0000)
committerJeff Johnson <jeff.johnson@oss.qualcomm.com>
Thu, 9 Jul 2026 14:44:42 +0000 (07:44 -0700)
commit7f11e70629650ff6ea140984e5ce188b775b2683
tree0e972d8cd781ddadc75945c2adb58d58b13569c7
parent7393878255e492515858f751ba4c260f248fb108
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

When the first entry in msdu_details has a zero buffer address,
the code accesses msdu_details[i - 1] with i == 0, causing a
buffer underflow.

Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding
a separate check for i == 0 before the main condition to prevent
the out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260530114252.42615-1-d.morgun@ispras.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
drivers/net/wireless/ath/ath11k/dp_rx.c