On 12/7/2024 12:43 PM, Dheeraj Reddy Jonnalagadda wrote:
Add a bounds check to ath12k_mac_vdev_create() to prevent an out-of-bounds read in the vif->link_conf array. The function uses link_id, derived from arvif->link_id, to index the array. When link_id equals 15, the index exceeds the bounds of the array, which contains only 15 elements. This issue occurs in the following code branch: if (arvif->link_id == ATH12K_DEFAULT_SCAN_LINK && vif->valid_links) link_id = ffs(vif->valid_links) - 1; else link_id = arvif->link_id; When the first condition in the if statement is true and the second condition is false, it implies that arvif->link_id equals 15 and the else branch is taken, where link_id is set to 15, causing an out-of-bounds access when vif->link_conf array is read using link_id as index.
Practically this can not happen as ath12k_mac_assign_link_vif() which retrieves the arvif by link_id before calling ath12k_mac_vdev_create() sanitizes the link_id when there are no valid_links running for that vif (!vif->valid_links). Vasanth