From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E4A732C3252; Wed, 25 Feb 2026 06:56:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772002578; cv=none; b=YXTO4ZoUKCwKdecV3qbW/8aVRanfIS2cSjp8i5MZvO4mKnWka0lK7clo+mAOToQaNMrcXpFt607b3ejDwTXuaKQ5CqX5s3YFPHlNQX4dMgauvf9N3WLQKBe3cHxkAt3R4pH7fI/INLc5mt/fiSQFAf+akTaDW+ud+wBB8p/Z7A8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772002578; c=relaxed/simple; bh=CYfjDcp/wyadi8AXCFZznbHGj+lv6mMXyyUsxLc7z+Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SjzZL1JlGq/I3Oi8Bl+Hm1uib1f12IXCragDRTtTYWdMrCRAyGR+xiXQKvOPIRyZsXPVF5X93FBLVtbgDBqRTWbcegyFKEyTDBcCqmeCKaFs1tfRRxTMmZFUPH24q4PVVDNwjkstxv6OcYe2jbUp37jYM647ceMpY1PZxC3tufA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vUZFgxFa; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vUZFgxFa" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BD87CC116D0; Wed, 25 Feb 2026 06:56:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1772002577; bh=CYfjDcp/wyadi8AXCFZznbHGj+lv6mMXyyUsxLc7z+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vUZFgxFaLz9hehd49/ewQKOi//Gvjwzd5OqhljVdkbGJ5lpSakMpPPLb5MSplIJkI DoHyyRYNUCLisdKSRhvyNdU5kUh2atwWjYz6Tojjz7/Qv6Hn1UYDs0dKOTzFWkOn+q oNgy/r+Q0U+s74nuNyj8DM1ZfnEffxxYf/71RnbM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Aaradhana Sahu , Baochen Qiang , Jeff Johnson , Sasha Levin Subject: [PATCH 6.18 285/641] wifi: ath12k: Fix index decrement when array_len is zero Date: Tue, 24 Feb 2026 17:20:11 -0800 Message-ID: <20260225012355.671701402@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260225012348.915798704@linuxfoundation.org> References: <20260225012348.915798704@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Aaradhana Sahu [ Upstream commit e4763898bb1325dbb3792961b6d607b5c6452d64 ] Currently, print_array_to_buf_index() decrements index unconditionally. This may lead to invalid buffer access when array_len is zero. Fix this by decrementing index only when array_len is non-zero. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: adf6df963c03 ("wifi: ath12k: Add support to parse requested stats_type") Signed-off-by: Aaradhana Sahu Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123071253.2202644-2-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c b/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c index 48b010a1b7566..4f749d473d0e1 100644 --- a/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c +++ b/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: BSD-3-Clause-Clear /* * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. - * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include @@ -29,8 +29,10 @@ print_array_to_buf_index(u8 *buf, u32 offset, const char *header, u32 stats_inde " %u:%u,", stats_index++, le32_to_cpu(array[i])); } /* To overwrite the last trailing comma */ - index--; - *(buf + offset + index) = '\0'; + if (array_len > 0) { + index--; + *(buf + offset + index) = '\0'; + } if (footer) { index += scnprintf(buf + offset + index, -- 2.51.0