Re: [PATCH] net: wwan: iosm: validate msg_head before indexing msg_ring

[Loic Poulain]

On Tue, Oct 20, 2026 at 11:42 AM liuc63 <liuc63@xxxxxxxxxxxx> wrote:
>
> From: Liu Chao <liuc63@xxxxxxxxxxxx>
>
> ipc_protocol_free_msg_get() reads msg_head from shared memory and
> uses it directly as an index into msg_ring[]. If the head is out
> of range, the subsequent memset() writes beyond the message ring.
>
> Validate head against IPC_MEM_MSG_ENTRIES before using it as an
> index. The ring is a circular buffer, so a value outside the valid
> range indicates a corrupted head pointer; report the error and fail
> the allocation instead of writing out of bounds.
>
> Fixes: 64516f633bfd ("net: iosm: protocol operations")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Fang Xieyan <fangxy@xxxxxxxxxxxx>
> Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>

Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>

> ---
>  drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> index f2f86f41fd10..004920068c45 100644
> --- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> +++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> @@ -14,6 +14,11 @@ ipc_protocol_free_msg_get(struct iosm_protocol *ipc_protocol, int *index)
>         u32 new_head = (head + 1) % IPC_MEM_MSG_ENTRIES;
>         union ipc_mem_msg_entry *msg;
>
> +       if (head >= IPC_MEM_MSG_ENTRIES) {
> +               dev_err(ipc_protocol->dev, "invalid message head %u", head);
> +               return NULL;
> +       }
> +
>         if (new_head == le32_to_cpu(ipc_protocol->p_ap_shm->msg_tail)) {
>                 dev_err(ipc_protocol->dev, "message ring is full");
>                 return NULL;
> --
> 2.50.1
>