diff mbox series

[v2] wifi: ath11k: fix writing to unintended memory region

Message ID 20230321052900.16895-1-quic_ppranees@quicinc.com
State New
Headers show
Series [v2] wifi: ath11k: fix writing to unintended memory region | expand

Commit Message

Praneesh P March 21, 2023, 5:29 a.m. UTC
While initializing spectral, the magic value is getting written to the
invalid memory address leading to random boot-up crash. This occurs
due to the incorrect index increment in ath11k_dbring_fill_magic_value
function. Fix it by replacing the existing logic with memset32 to ensure
there is no invalid memory access.

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1

Fixes: d3d358efc553 ("ath11k: add spectral/CFR buffer validation support")
Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
---
v2:
	- Remove extra space between fixes and signed off tag.
---
 drivers/net/wireless/ath/ath11k/dbring.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)


base-commit: 3df3715e556027e94246b2cb30986563362a65f4

Comments

Kalle Valo April 12, 2023, 10:01 a.m. UTC | #1
P Praneesh <quic_ppranees@quicinc.com> wrote:

> While initializing spectral, the magic value is getting written to the
> invalid memory address leading to random boot-up crash. This occurs
> due to the incorrect index increment in ath11k_dbring_fill_magic_value
> function. Fix it by replacing the existing logic with memset32 to ensure
> there is no invalid memory access.
> 
> Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
> 
> Fixes: d3d358efc553 ("ath11k: add spectral/CFR buffer validation support")
> Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>

Patch applied to ath-next branch of ath.git, thanks.

756a7f90878f wifi: ath11k: fix writing to unintended memory region
diff mbox series

Patch

diff --git a/drivers/net/wireless/ath/ath11k/dbring.c b/drivers/net/wireless/ath/ath11k/dbring.c
index 2107ec05d14f..f072067a75e4 100644
--- a/drivers/net/wireless/ath/ath11k/dbring.c
+++ b/drivers/net/wireless/ath/ath11k/dbring.c
@@ -26,13 +26,14 @@  int ath11k_dbring_validate_buffer(struct ath11k *ar, void *buffer, u32 size)
 static void ath11k_dbring_fill_magic_value(struct ath11k *ar,
 					   void *buffer, u32 size)
 {
-	u32 *temp;
-	int idx;
 
-	size = size >> 2;
+	/* memset32 function fills buffer payload with the ATH11K_DB_MAGIC_VALUE
+	 * and the variable size is expected to be the number of u32 values
+	 * to be stored, not the number of bytes.
+	 */
+	size = size / sizeof(u32);
 
-	for (idx = 0, temp = buffer; idx < size; idx++, temp++)
-		*temp++ = ATH11K_DB_MAGIC_VALUE;
+	memset32(buffer, ATH11K_DB_MAGIC_VALUE, size);
 }
 
 static int ath11k_dbring_bufs_replenish(struct ath11k *ar,