ath1k driver RX monitor ring infinite loop kernel crash fix

ath1k Driver Infinite Loop Vulnerability Summary Vulnerability Overview Vulnerability Type: An infinite loop causing a kernel crash. Trigger Scenario: While processing the monitor destination ring, the driver fails to obtain a valid buffer corresponding to the , leading to repeated retries in the destination ring processing, resulting in a dead loop. Kernel Log Characteristics: Scope of Impact Affected Driver: wireless network card driver (Qualcomm IEEE 802.11ax devices). Tested/Reproduced on Hardware: - WCMB55 2.0 PCI WLAN - HSP 1.1-03125-OCAM55PML V1 U2 SILLICONZ LITE-3.6510.70 - OCAM974 2.0 PCI WLAN - MW 2.7.0-01744-OCAM55PML V1 U2 SILLICONZ-1 Fix Commit: (commit message: ). Fix Fix Approach: Skip the problematic destination ring entry (the problematic buf id) and resume processing the next entry, thereby breaking the infinite loop. Code Change ( ): ```c diff --git a/drivers/net/wireless/ath/ath1k/dp_rx.c b/drivers/net/wireless/ath/ath1k/dp_rx.c index a473e4565c9c..9845428d5ee 100644 --- a/drivers/net/wireless/ath/ath1k/dp_rx.c +++ b/drivers/net/wireless/ath/ath1k/dp_rx.c @@ -4747,4 +4754,7 @@ data_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_mdu_m

Goal Reached Thanks to every supporter — we hit 100%!

ath1k driver RX monitor ring infinite loop kernel crash fix

More from this source