wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

When the first entry in msdu_details has a zero buffer address,
the code accesses msdu_details[i - 1] with i == 0, causing a
buffer underflow.

Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding
a separate check for i == 0 before the main condition to prevent
the out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260530114252.42615-1-d.morgun@ispras.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 9e90d8e3f1557a1ae0e54c8dfd8c4d8b253cac15..8e2abc7b8383a0542aab2894fb23cd4bc80c7921 100644 (file)
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -4618,6 +4618,9 @@ static void ath11k_hal_rx_msdu_list_get(struct ath11k *ar,
        msdu_details = &msdu_link->msdu_link[0];
 
        for (i = 0; i < HAL_RX_NUM_MSDU_DESC; i++) {
+               if (!i && FIELD_GET(BUFFER_ADDR_INFO0_ADDR,
+                                   msdu_details[i].buf_addr_info.info0) == 0)
+                       break;
                if (FIELD_GET(BUFFER_ADDR_INFO0_ADDR,
                              msdu_details[i].buf_addr_info.info0) == 0) {
                        msdu_desc_info = &msdu_details[i - 1].rx_msdu_info;