Re: [PATCH rtw-next v2 2/2] wifi: rtw88: check the C2H payload length before reading it

["Luka Gejak" <luka.gejak@linux.dev>]

Hi Huihui,

Thanks for the v2. One comment below.

October 31, 2026 at 6:56 PM, "Huihui Huang" <hhhuang@smu.edu.sg> wrote:

> diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
> index 0a909bf79cf5..6bc684726669 100644
> --- a/drivers/net/wireless/realtek/rtw88/fw.c
> +++ b/drivers/net/wireless/realtek/rtw88/fw.c

[ ... ]

> @@ -2381,6 +2386,9 @@ void rtw_hw_scan_status_report(struct rtw_dev *rtwdev, struct sk_buff *skb)
>       if (!test_bit(RTW_FLAG_SCANNING, rtwdev->flags))
>               return;
>
> +     if (rtw_c2h_payload_len(skb) < 3)
> +             return;
> +

As far as I can see, apart from the abort paths this report is the only
thing that completes a hw scan. So, a short report now leaves the scan
pending. RTW_FLAG_SCANNING stays set, scanning_vif is never cleared,
and I couldn't find anything in rtw88 that times the scan out.

Until something cancels it, e.g. a disconnect or the interface going
down, every new scan then fails with -EBUSY, since the old request is
still pending.

Before this patch the scan still completed, only with a return code read
past skb->len. Maybe it is better to complete it as aborted here instead
of dropping the report, something like:

        if (rtw_c2h_payload_len(skb) < 3) {
                rtw_hw_scan_complete(rtwdev, vif, true);
                return;
        }

Best regards,
Luka Gejak