[PATCH 1/2] wifi: ath10k: Add missing validation in debugfs mem_value and reg_value

[Jeff Johnson]

On 9/10/2026 1:06 AM, Rivaldi Hormat wrote:

where is your commit text?

please review all of:
https://www.kernel.org/doc/html/latest/process/submitting-patches.html
https://wireless.docs.kernel.org/en/latest/en/users/drivers/ath10k/submittingpatches.html

> Signed-off-by: Rivaldi Hormat <rivaldihormat at gmail.com>
> ---
>  drivers/net/wireless/ath/ath10k/debug.c | 20 ++++++++++++++++++++
>  1 file changed, 20 insertions(+)
> 
> diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
> index fb61e53ff..50e017021 100644
> --- a/drivers/net/wireless/ath/ath10k/debug.c
> +++ b/drivers/net/wireless/ath/ath10k/debug.c
> @@ -729,6 +729,13 @@ static ssize_t ath10k_reg_value_write(struct file *file,
>  
>  	reg_addr = ar->debug.reg_addr;
>  
> +	/* FIX: Validate register address */

avoid comments that just restate code

> +	if (reg_addr > ar->hw_params.reg_size) {
> +		ath10k_warn(ar, "Invalid register address 0x%08x\n", reg_addr);
> +		ret = -EINVAL;
> +		goto exit;
> +	}
> +
>  	ret = kstrtou32_from_user(user_buf, count, 0, &reg_val);
>  	if (ret)
>  		goto exit;
> @@ -819,6 +826,19 @@ static ssize_t ath10k_mem_value_write(struct file *file,
>  
>  	mutex_lock(&ar->conf_mutex);
>  
> +	/* FIX: Validate address against memory size */
> +	if (*ppos > ar->hw_params.mem_size) {
> +		ath10k_warn(ar, "Invalid address 0x%08x for mem_value\n", (u32)*ppos);
> +		return -EINVAL;
> +	}
> +
> +	/* FIX: Validate size against remaining memory */
> +	if (count > ar->hw_params.mem_size - *ppos) {
> +		ath10k_warn(ar, "Invalid size %zu for mem_value at 0x%08x\n",
> +			    count, (u32)*ppos);
> +		return -EINVAL;
> +	}
> +
>  	buf = vmalloc(count);
>  	if (!buf) {
>  		ret = -ENOMEM;