All of lore.kernel.org
 help / color / mirror / Atom feed
From: Luka Gejak <luka.gejak@linux.dev>
To: Zeshan Ahmed Nobin <zeshanahmednobin@gmail.com>,
	linux-wireless@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, Ping-Ke Shih <pkshih@realtek.com>,
	Kalle Valo <kvalo@kernel.org>
Subject: Re: [PATCH RESEND rtw-next v2 2/2] wifi: rtw88: 8822c: ignore nrx values without CCK PD registers
Date: Mon, 09 Nov 2026 07:43:00 +0100	[thread overview]
Message-ID: <2C4EC68D-1844-4124-A40D-FD0BA0627A44@linux.dev> (raw)
In-Reply-To: <20261108182837.682661-3-zeshanahmednobin@gmail.com>

On November 8, 2026 7:28:37 PM GMT+01:00, Zeshan Ahmed Nobin
<zeshanahmednobin@gmail.com> wrote:
>rtw8822c_phy_cck_pd_set() reads nrx, the number of CCK RX paths minus
>one, from a 2-bit register field. The driver only ever sets it to 0 or
>1, for one or two RX paths (see rtw8822c_config_cck_rx_path()), and
>rtw8822c_cck_pd_reg[] only has registers for those two values; its
>entries for nrx 2 and 3 are all zero.
>
>A device that stops responding can return any value. On USB, a failed
>read returns whatever an earlier read left in the buffer, so bw can be
>0 or 1 while nrx is 2 or 3. When the level then changes,
>rtw8822c_phy_cck_pd_set_reg() gets past its WARN_ON(), which only
>checks nrx against RTW_RF_PATH_MAX, and calls rtw_read32_mask() and
>rtw_write32_mask() on register 0x0 with a zero mask. Both compute
>__ffs(0), which is undefined, and the write puts back whatever was read
>from register 0x0.
>
>Return early when rtw8822c_cck_pd_reg[] has no registers for nrx; bw
>has already been checked at that point.
>
>The fix and this message were drafted with an AI coding assistant
>(Claude Opus 5.5 by Anthropic), then reviewed and tested by the
>submitter.
>
>Reported-by: Luka Gejak <luka.gejak@linux.dev>
>Closes: https://lore.kernel.org/linux-wireless/f6a7d3272fe7635c6a83698dfab5d85500437ca6@linux.dev/
>Fixes: 479c4ee931a6 ("rtw88: add dynamic cck pd mechanism")
>Signed-off-by: Zeshan Ahmed Nobin <zeshanahmednobin@gmail.com>
>---

Looks good to me,

Reviewed-by: Luka Gejak <luka.gejak@linux.dev>


Best regards,
Luka Gejak

      reply	other threads:[~2026-11-09  6:43 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-08 18:28 [PATCH RESEND rtw-next v2 0/2] wifi: rtw88: 8822c: check register values in cck_pd_set Zeshan Ahmed Nobin
2026-11-08 18:28 ` [PATCH RESEND rtw-next v2 1/2] wifi: rtw88: 8822c: fix out-of-bounds access " Zeshan Ahmed Nobin
2026-11-09  6:41   ` Luka Gejak
2026-11-09 18:20     ` Zeshan Ahmed Nobin
2026-11-09 19:24       ` Luka Gejak
2026-11-08 18:28 ` [PATCH RESEND rtw-next v2 2/2] wifi: rtw88: 8822c: ignore nrx values without CCK PD registers Zeshan Ahmed Nobin
2026-11-09  6:43   ` Luka Gejak [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2C4EC68D-1844-4124-A40D-FD0BA0627A44@linux.dev \
    --to=luka.gejak@linux.dev \
    --cc=kvalo@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=pkshih@realtek.com \
    --cc=zeshanahmednobin@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.