From 46cbf85155e5451b6682ea0c17bc62ec564aec36 Mon Sep 17 00:00:00 2001 From: Liu Chao Date: Tue, 20 Oct 2026 17:42:49 +0800 Subject: [PATCH] net: wwan: iosm: validate msg_head before indexing msg_ring ipc_protocol_free_msg_get() reads msg_head from shared memory and uses it directly as an index into msg_ring[]. If the head is out of range, the subsequent memset() writes beyond the message ring. Validate head against IPC_MEM_MSG_ENTRIES before using it as an index. The ring is a circular buffer, so a value outside the valid range indicates a corrupted head pointer; report the error and fail the allocation instead of writing out of bounds. Fixes: 64516f633bfd ("net: iosm: protocol operations") Cc: stable@vger.kernel.org Reviewed-by: Fang Xieyan Signed-off-by: Liu Chao Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20261020094254.4017726-1-liuc63@xiaopeng.com Signed-off-by: Jakub Kicinski --- drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c index f2f86f41fd10..004920068c45 100644 --- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c +++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c @@ -14,6 +14,11 @@ ipc_protocol_free_msg_get(struct iosm_protocol *ipc_protocol, int *index) u32 new_head = (head + 1) % IPC_MEM_MSG_ENTRIES; union ipc_mem_msg_entry *msg; + if (head >= IPC_MEM_MSG_ENTRIES) { + dev_err(ipc_protocol->dev, "invalid message head %u", head); + return NULL; + } + if (new_head == le32_to_cpu(ipc_protocol->p_ap_shm->msg_tail)) { dev_err(ipc_protocol->dev, "message ring is full"); return NULL;