[PATCH] net: wwan: iosm: validate msg_head before indexing msg_ring

[PATCH] net: wwan: iosm: validate msg_head before indexing msg_ring

[liuc63]

From: Liu Chao <liuc63@xiaopeng.com>

ipc_protocol_free_msg_get() reads msg_head from shared memory and
uses it directly as an index into msg_ring[]. If the head is out
of range, the subsequent memset() writes beyond the message ring.

Validate head against IPC_MEM_MSG_ENTRIES before using it as an
index. The ring is a circular buffer, so a value outside the valid
range indicates a corrupted head pointer; report the error and fail
the allocation instead of writing out of bounds.

Fixes: 64516f633bfd ("net: iosm: protocol operations")
Cc: stable@vger.kernel.org
Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
index f2f86f41fd10..004920068c45 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
@@ -14,6 +14,11 @@ ipc_protocol_free_msg_get(struct iosm_protocol *ipc_protocol, int *index)
 	u32 new_head = (head + 1) % IPC_MEM_MSG_ENTRIES;
 	union ipc_mem_msg_entry *msg;
 
+	if (head >= IPC_MEM_MSG_ENTRIES) {
+		dev_err(ipc_protocol->dev, "invalid message head %u", head);
+		return NULL;
+	}
+
 	if (new_head == le32_to_cpu(ipc_protocol->p_ap_shm->msg_tail)) {
 		dev_err(ipc_protocol->dev, "message ring is full");
 		return NULL;
-- 
2.50.1

Re: [PATCH] net: wwan: iosm: validate msg_head before indexing msg_ring

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net: wwan: iosm: validate msg_head before indexing msg_ring

[Loic Poulain]

On Tue, Oct 20, 2026 at 11:42 AM liuc63 <liuc63@xiaopeng.com> wrote:
>
> From: Liu Chao <liuc63@xiaopeng.com>
>
> ipc_protocol_free_msg_get() reads msg_head from shared memory and
> uses it directly as an index into msg_ring[]. If the head is out
> of range, the subsequent memset() writes beyond the message ring.
>
> Validate head against IPC_MEM_MSG_ENTRIES before using it as an
> index. The ring is a circular buffer, so a value outside the valid
> range indicates a corrupted head pointer; report the error and fail
> the allocation instead of writing out of bounds.
>
> Fixes: 64516f633bfd ("net: iosm: protocol operations")
> Cc: stable@vger.kernel.org
> Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>

Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>

> ---
>  drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> index f2f86f41fd10..004920068c45 100644
> --- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> +++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> @@ -14,6 +14,11 @@ ipc_protocol_free_msg_get(struct iosm_protocol *ipc_protocol, int *index)
>         u32 new_head = (head + 1) % IPC_MEM_MSG_ENTRIES;
>         union ipc_mem_msg_entry *msg;
>
> +       if (head >= IPC_MEM_MSG_ENTRIES) {
> +               dev_err(ipc_protocol->dev, "invalid message head %u", head);
> +               return NULL;
> +       }
> +
>         if (new_head == le32_to_cpu(ipc_protocol->p_ap_shm->msg_tail)) {
>                 dev_err(ipc_protocol->dev, "message ring is full");
>                 return NULL;
> --
> 2.50.1
>