diff options
| author | Tristan Madani <tristan@talencesecurity.com> | 2026-04-16 01:23:43 +0300 |
|---|---|---|
| committer | Jeff Johnson <jeff.johnson@oss.qualcomm.com> | 2026-05-01 00:24:07 +0300 |
| commit | 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 (patch) | |
| tree | d3691c7a152a7b756502e8e3a1ec9b363c89113a /include/linux/debugobjects.h | |
| parent | 3042a9d403b9ead7c35b55e697eeae7974e04653 (diff) | |
| download | linux-7ce2f118a2389e8f0a64068c6fe7cc7d40639be0.tar.xz | |
wifi: ath9k: fix OOB access from firmware tx status queue ID
ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
4-bit hardware field (0-15), but the txq array only has
ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
access.
Add a bounds check on ts.qid before using it as an array index.
Fixes: fce041beb03f ("ath9k: unify edma and non-edma tx code, improve tx fifo handling")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260415222343.1540564-1-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Diffstat (limited to 'include/linux/debugobjects.h')
0 files changed, 0 insertions, 0 deletions