[Bug 299427] iwm: mask closed_rb_num to the RX ring size (9000 step A0 hardening)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299427

            Bug ID: 299427
           Summary: iwm: mask closed_rb_num to the RX ring size (9000 step
                    A0 hardening)
           Product: Base System
           Version: Unspecified
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: david@crap.solutions

Created attachment 275746
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=275746&action=edit
iwm: mask closed_rb_num to the RX ring size (9000 step A0 hardening)

iwm_notif_intr() reads hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff and
loops while (sc->rxq.cur != hw) without masking hw to the ring size (512
entries
for 9000-series MQ RX, 256 for legacy). If the hardware reports a value at or
above the ring size, cur never equals hw: the loop walks stale ring entries
indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi
masks the value (5eae443eb5e2) and OpenBSD has done the same since 9000-series
support was added (3287dca4fa10).

This was found while debugging an iwm crash on another BSD using the same
driver lineage (DragonFly, upstream bug 3449)

-- 
You are receiving this mail because:
You are the assignee for the bug.