From: Tristan Madani <tristan@talencesecurity.com>

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
4-bit hardware field (0-15), but the txq array only has
ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
access.

Add a bounds check on ts.qid before using it as an array index.

Fixes: fce041beb03f ("ath9k: unify edma and non-edma tx code, improve tx fifo handling")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Note: v2 resubmission -- original sent via Gmail had HTML rendering
issues. This version uses git send-email for plain-text formatting.

drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index XXXXXXX..XXXXXXX 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2755,6 +2755,11 @@ static void ath_tx_edma_tasklet(struct ath_softc *sc)
 			continue;
 		}

+		if (ts.qid >= ATH9K_NUM_TX_QUEUES) {
+			ath_dbg(common, XMIT, "invalid qid %d\n", ts.qid);
+			continue;
+		}
+
 		txq = &sc->tx.txq[ts.qid];

 		ath_txq_lock(sc, txq);
--
2.43.0

On Wed, 15 Apr 2026 22:23:43 +0000, Tristan Madani wrote:
> ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
> 4-bit hardware field (0-15), but the txq array only has
> ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
> access.
> 
> Add a bounds check on ts.qid before using it as an array index.
> 
> [...]

Applied, thanks!

[1/1] wifi: ath9k: fix OOB access from firmware tx status queue ID
      commit: 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0

Best regards,
-- 
Jeff Johnson <jeff.johnson@oss.qualcomm.com>

Thanks for applying, Jeff.

Would you mind adding a Reported-by tag as well? I am both the finder
and the fixer:

Reported-by: Tristan Madani <tristan@talencesecurity.com>

Best,
Tristan

On 5/4/2026 11:40 AM, Tristan Madani wrote:
> Thanks for applying, Jeff.
> 
> Would you mind adding a Reported-by tag as well? I am both the finder
> and the fixer:
> 
> Reported-by: Tristan Madani <tristan@talencesecurity.com>
Unfortunately that is a public immutable branch so the commit can no longer be
modified.

/jeff

Tristan Madani <tristmd@gmail.com> writes:

> From: Tristan Madani <tristan@talencesecurity.com>
>
> ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
> 4-bit hardware field (0-15), but the txq array only has
> ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
> access.
>
> Add a bounds check on ts.qid before using it as an array index.
>
> Fixes: fce041beb03f ("ath9k: unify edma and non-edma tx code, improve tx fifo handling")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>