RE: [PATCH v2] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

[Ping-Ke Shih <pkshih@realtek.com>]

Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> On 20/04/2026 08:31, Ping-Ke Shih wrote:
> > Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> >>
> >> Well, kind of. Maybe RTK_PCI_RX_BUF_SIZE is too small? 11454 + 24
> >> doesn't take into account the PHY info size.
> >
> > In rtw_pci_sync_rx_desc_device(), driver does
> >     buf_desc->buf_size = cpu_to_le16(RTK_PCI_RX_BUF_SIZE);
> >
> > This is to tell hardware the size of RX DMA buffer. I think hardware
> > can't DMA data over this size.
> >
> 
> Indeed, I don't think the hardware will write more than
> RTK_PCI_RX_BUF_SIZE bytes. But I wonder if some bytes won't be lost
> (or the entire packet?) if it ever receives a frame of 11454 bytes
> and wants to attach a PHY status? Then it would need a buffer of
> 11454 + 24 + 32 bytes. I don't know if this ever happens.

I think the total size including PHY status must be smaller than
RTK_PCI_RX_BUF_SIZE, otherwise we should enlarge RTK_PCI_RX_BUF_SIZE.

The rtw89 can split a packet into multiple segments if RX buffer is 
smaller than a receiving packet, but it has exact overload, so we
enlarge the buffer as large as necessary. 

For rtw88, I can't find similar implementation. Maybe we can try to
enlarge the size to see if any improvement. 

Ping-Ke