[PATCH v3] wifi: rtw89: add bounds check on firmware mac_id in link lookup

Tristan Madani
2026-04-21T11:01:37Z

- v2 resubmission with plain-text formatting (git send-email).
Per Ping-Ke Shih: defensive framing (firmware assigns < 128
today, but descriptor field is 8-bit).

drivers/net/wireless/realtek/rtw89/core.h | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index XXXXXXX..XXXXXXX 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -6435,6 +6435,9 @@ static inline struct rtw89_sta_link *
rtw89_assoc_link_rcu_dereference(struct rtw89_dev *rtwdev, u8 macid)
{
+ if (unlikely(macid >= RTW89_MAX_MAC_ID_NUM))
+ return NULL;
+
return rcu_dereference(rtwdev->assoc_link_on_macid[macid]);
}
--
2.47.3