linux/drivers/net/wireless
P Praneesh ab7edf42ce wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
commit 63fdc4509b upstream.

Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry
to fetch the next entry from the destination ring. This is incorrect because
ath12k_hal_srng_src_get_next_entry is intended for source rings, not destination
rings. This leads to invalid entry fetches, causing potential data corruption or
crashes due to accessing incorrect memory locations. This happens because the
source ring and destination ring have different handling mechanisms and using
the wrong function results in incorrect pointer arithmetic and ring management.

To fix this issue, replace the call to ath12k_hal_srng_src_get_next_entry with
ath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process. This ensures
that the correct function is used for fetching entries from the destination
ring, preventing invalid memory accesses.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
Link: https://patch.msgid.link/20241223060132.3506372-7-quic_ppranees@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-04-25 10:48:07 +02:00
..
admtek wifi: mac80211: inform the low level if drv_stop() is a suspend 2024-06-26 10:25:46 +02:00
ath wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process 2025-04-25 10:48:07 +02:00
atmel wifi: at76c50x: fix use after free access in at76_disconnect 2025-04-25 10:47:37 +02:00
broadcom wifi: brcmfmac: keep power during suspend if board requires it 2025-04-10 14:39:28 +02:00
intel wifi: iwlwifi: mvm: use the right version of the rate API 2025-04-10 14:39:28 +02:00
intersil wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() 2024-12-05 14:01:37 +01:00
marvell wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() 2024-12-05 14:01:45 +01:00
mediatek wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO 2025-04-20 10:15:40 +02:00
microchip wifi: wilc1000: Set MAC after operation mode 2024-12-05 14:01:45 +01:00
purelifi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
quantenna wifi: cfg80211: handle DFS per link 2024-09-06 13:01:05 +02:00
ralink wifi: mac80211: inform the low level if drv_stop() is a suspend 2024-06-26 10:25:46 +02:00
realtek wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit 2025-02-21 14:01:46 +01:00
rsi wifi: rsi: Remove an unused field in struct rsi_debugfs 2024-09-09 15:30:49 +03:00
silabs wifi: wfx: Fix error handling in wfx_core_init() 2024-12-05 14:01:51 +01:00
st wifi: cw1200: Fix potential NULL dereference 2024-12-05 14:01:51 +01:00
ti wifi: wl1251: fix memory leak in wl1251_tx_work 2025-04-25 10:47:37 +02:00
virtual wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings 2024-10-08 21:24:20 +02:00
zydas move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
Kconfig wifi: remove orphaned rndis_wlan driver 2023-10-30 19:30:33 +02:00
Makefile wifi: remove orphaned rndis_wlan driver 2023-10-30 19:30:33 +02:00