[PATCH 1/2] wifi: ath10k: Add missing validation in debugfs mem_value and reg_value
From: Rivaldi Hormat <hidden>
Date: 2026-09-11 07:24:22
Subsystem:
atheros ath generic utilities, qualcomm atheros ath10k wireless driver, the rest · Maintainers:
Jeff Johnson, Linus Torvalds
mem_value and reg_value don't validate the address and size provided by the user. This can lead to out-of-bounds access to hardware memory and registers. Fix this by adding the missing validation. Signed-off-by: Rivaldi Hormat <redacted> --- drivers/net/wireless/ath/ath10k/debug.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index fb61e53ff..50e017021 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c@@ -729,6 +729,13 @@ static ssize_t ath10k_reg_value_write(struct file *file, reg_addr = ar->debug.reg_addr; + /* FIX: Validate register address */ + if (reg_addr > ar->hw_params.reg_size) { + ath10k_warn(ar, "Invalid register address 0x%08x\n", reg_addr); + ret = -EINVAL; + goto exit; + } + ret = kstrtou32_from_user(user_buf, count, 0, ®_val); if (ret) goto exit;
@@ -819,6 +826,19 @@ static ssize_t ath10k_mem_value_write(struct file *file, mutex_lock(&ar->conf_mutex); + /* FIX: Validate address against memory size */ + if (*ppos > ar->hw_params.mem_size) { + ath10k_warn(ar, "Invalid address 0x%08x for mem_value\n", (u32)*ppos); + return -EINVAL; + } + + /* FIX: Validate size against remaining memory */ + if (count > ar->hw_params.mem_size - *ppos) { + ath10k_warn(ar, "Invalid size %zu for mem_value at 0x%08x\n", + count, (u32)*ppos); + return -EINVAL; + } + buf = vmalloc(count); if (!buf) { ret = -ENOMEM;
--
2.53.0