[Bug 299427] iwm: mask closed_rb_num to the RX ring size (9000 step A0 hardening)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299427

--- Comment #4 from commit-hook@FreeBSD.org ---
A commit in branch stable/15 references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=b71d79c270ff7561838cd7dfd2abb8b000cd4d64

commit b71d79c270ff7561838cd7dfd2abb8b000cd4d64
Author:     Adrian Chadd <adrian@FreeBSD.org>
AuthorDate: 2026-10-17 21:32:51 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-10-30 17:38:26 +0000

    iwm: mask closed_rb_num to the RX ring size

    iwm_notif_intr() reads hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff
and
    loops while (sc->rxq.cur != hw) without masking hw to the ring size (512
entries
    for 9000-series MQ RX, 256 for legacy). If the hardware reports a value at
or
    above the ring size, cur never equals hw: the loop walks stale ring entries
    indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi
    masks the value (5eae443eb5e2) and OpenBSD has done the same since
9000-series
    support was added (3287dca4fa10).

    This was found while debugging an iwm crash on another BSD using the same
    driver lineage (DragonFly, upstream bug 3449)

    Locally tested:

    * 7260, 9260, STA mode

    PR: kern/299427
    Submitted by: David Bidner <david@crap.solutions>

    Differential Revision:  https://reviews.freebsd.org/D60824

    (cherry picked from commit 461da47e45e7f8ef8754875f4820d3855e7f4097)

 sys/dev/iwm/if_iwm.c    | 2 ++
 sys/dev/iwm/if_iwmvar.h | 1 +
 2 files changed, 3 insertions(+)

-- 
You are receiving this mail because:
You are the assignee for the bug.