diff options
| author | Liu Chao <liuc63@xiaopeng.com> | 2026-10-20 17:42:49 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-10-21 17:31:01 -0700 |
| commit | 46cbf85155e5451b6682ea0c17bc62ec564aec36 (patch) | |
| tree | 4d239f99e6e4408806a1fdc3f3433208c66ea91e /drivers | |
| parent | 77dac783f113dcc4576efca6f4391d7324c0b1fc (diff) | |
| download | linux-46cbf85155e5451b6682ea0c17bc62ec564aec36.tar.gz linux-46cbf85155e5451b6682ea0c17bc62ec564aec36.zip | |
net: wwan: iosm: validate msg_head before indexing msg_ring
ipc_protocol_free_msg_get() reads msg_head from shared memory and
uses it directly as an index into msg_ring[]. If the head is out
of range, the subsequent memset() writes beyond the message ring.
Validate head against IPC_MEM_MSG_ENTRIES before using it as an
index. The ring is a circular buffer, so a value outside the valid
range indicates a corrupted head pointer; report the error and fail
the allocation instead of writing out of bounds.
Fixes: 64516f633bfd ("net: iosm: protocol operations")
Cc: stable@vger.kernel.org
Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20261020094254.4017726-1-liuc63@xiaopeng.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c index f2f86f41fd10..004920068c45 100644 --- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c +++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c @@ -14,6 +14,11 @@ ipc_protocol_free_msg_get(struct iosm_protocol *ipc_protocol, int *index) u32 new_head = (head + 1) % IPC_MEM_MSG_ENTRIES; union ipc_mem_msg_entry *msg; + if (head >= IPC_MEM_MSG_ENTRIES) { + dev_err(ipc_protocol->dev, "invalid message head %u", head); + return NULL; + } + if (new_head == le32_to_cpu(ipc_protocol->p_ap_shm->msg_tail)) { dev_err(ipc_protocol->dev, "message ring is full"); return NULL; |