[PATCH ath-next 3/3] wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region

[Jeff Johnson]

On 6/10/2026 8:33 PM, Aaradhana Sahu wrote:
> @@ -2781,9 +2781,12 @@ static int ath12k_qmi_assign_target_mem_chunk(struct ath12k_base *ab)
>  			goto out;
>  
>  		avail_rmem_size = resource_size(&res);
> -		if (chunk->type == BDF_MEM_REGION_TYPE) {
> +		if (chunk->type == BDF_MEM_REGION_TYPE ||
> +		    chunk->type == HOST_DDR_REGION_TYPE) {
>  			avail_rmem_size -= ab->hw_params->bdf_addr_offset;
> -			res.start += ab->hw_params->bdf_addr_offset;
> +			avail_rmem_size -= offset;
> +			res.start += ab->hw_params->bdf_addr_offset + offset;
> +			offset += chunk->size;

avail_rmem_size is size_t (unsigned).
If bdf_addr_offset + offset >= resource_size(&res) (e.g., DT
misconfiguration), the subtraction silently wraps to a huge value, the
avail_rmem_size < chunk->size guard passes incorrectly, and ioremap proceeds
out-of-bounds.

So seems there should be a test to sanitize the DT values.

>  		}
>  
>  		if (avail_rmem_size < chunk->size) {