ipc_protocol_free_msg_get() reads msg_head from shared memory and uses it directly as an index into msg_ring[]. If the head is out of range, the subsequent memset() writes beyond the message ring. Validate head against IPC_MEM_MSG_ENTRIES before using it as an index. The ring is a circular buffer, so a value outside the valid range indicates a corrupted head pointer; report the error and fail the allocation instead of writing out of bounds. Fixes: 64516f633bfd ("net: iosm: protocol operations") Cc: stable@vger.kernel.org Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com> Signed-off-by: Liu Chao <liuc63@xiaopeng.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20261020094254.4017726-1-liuc63@xiaopeng.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>