github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-29 18:51:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: ath9k: fix OOB access from firmware tx status queue ID

Browse Source 
ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
4-bit hardware field (0-15), but the txq array only has
ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
access.

Add a bounds check on ts.qid before using it as an array index.

Fixes: fce041beb0 ("ath9k: unify edma and non-edma tx code, improve tx fifo handling")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260415222343.1540564-1-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
This commit is contained in:
Tristan Madani 2026-04-15 22:23:43 +00:00 committed by Jeff Johnson
parent 3042a9d403
commit 7ce2f118a2
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/ath/ath9k/xmit.c
View File

@ -2744,6 +2744,11 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
continue;
}
if (ts.qid >= ATH9K_NUM_TX_QUEUES) {
ath_dbg(common, XMIT, "invalid qid %d\n", ts.qid);
continue;
}
txq = &sc->tx.txq[ts.qid];
ath_txq_lock(sc, txq);