Re: [PATCH ath-next 3/3] wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region
Aaradhana Sahu <[email protected]>
| Newsgroups | org.infradead.lists.ath12k,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <[email protected]> |
On 6/30/2026 6:06 AM, Jeff Johnson wrote:
> On 6/10/2026 8:33 PM, Aaradhana Sahu wrote:
>> @@ -2781,9 +2781,12 @@ static int ath12k_qmi_assign_target_mem_chunk(struct ath12k_base *ab)
>> goto out;
>>
>> avail_rmem_size = resource_size(&res);
>> - if (chunk->type == BDF_MEM_REGION_TYPE) {
>> + if (chunk->type == BDF_MEM_REGION_TYPE ||
>> + chunk->type == HOST_DDR_REGION_TYPE) {
>> avail_rmem_size -= ab->hw_params->bdf_addr_offset;
>> - res.start += ab->hw_params->bdf_addr_offset;
>> + avail_rmem_size -= offset;
>> + res.start += ab->hw_params->bdf_addr_offset + offset;
>> + offset += chunk->size;
>
> avail_rmem_size is size_t (unsigned).
> If bdf_addr_offset + offset >= resource_size(&res) (e.g., DT
> misconfiguration), the subtraction silently wraps to a huge value, the
> avail_rmem_size < chunk->size guard passes incorrectly, and ioremap proceeds
> out-of-bounds.
>
> So seems there should be a test to sanitize the DT values.
>
Sure, I will address this in the next version.
>> }
>>
>> if (avail_rmem_size < chunk->size) {
>