[Bug 299427] iwm: mask closed_rb_num to the RX ring size (9000 step A0 hardening)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299427

--- Comment #2 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=461da47e45e7f8ef8754875f4820d3855e7f4097

commit 461da47e45e7f8ef8754875f4820d3855e7f4097
Author:     Adrian Chadd <adrian@FreeBSD.org>
AuthorDate: 2026-10-17 21:32:51 +0000
Commit:     Adrian Chadd <adrian@FreeBSD.org>
CommitDate: 2026-10-17 21:32:51 +0000

    iwm: mask closed_rb_num to the RX ring size

    iwm_notif_intr() reads hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff
and
    loops while (sc->rxq.cur != hw) without masking hw to the ring size (512
entries
    for 9000-series MQ RX, 256 for legacy). If the hardware reports a value at
or
    above the ring size, cur never equals hw: the loop walks stale ring entries
    indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi
    masks the value (5eae443eb5e2) and OpenBSD has done the same since
9000-series
    support was added (3287dca4fa10).

    This was found while debugging an iwm crash on another BSD using the same
    driver lineage (DragonFly, upstream bug 3449)

    Locally tested:

    * 7260, 9260, STA mode

    PR: kern/299427
    Submitted by: David Bidner <david@crap.solutions>

    Differential Revision:  https://reviews.freebsd.org/D60824

 sys/dev/iwm/if_iwm.c    | 2 ++
 sys/dev/iwm/if_iwmvar.h | 1 +
 2 files changed, 3 insertions(+)

-- 
You are receiving this mail because:
You are the assignee for the bug.