[PATCH rtw-next] wifi: rtw88: validate RX rate to prevent out-of-bound

[PATCH rtw-next] wifi: rtw88: validate RX rate to prevent out-of-bound

[Ping-Ke Shih]

The reported RX rate might be unexpected, causing kernel warns:

  Rate marked as a VHT rate but data is invalid: MCS: 0, NSS: 0
  WARNING: net/mac80211/rx.c:5491 at ieee80211_rx_list+0x183/0x1020 [mac80211]

As the RX rate can be index of an array under certain conditions, validate
it to prevent accessing array out-of-bound potentially.

Reported-by: Oleksandr Havrylov <goainwo@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/CALdGYqSMUPnPfW-_q1RgYr0_SjoXUejAaJJr-o+jpwCk1S7ndQ@mail.gmail.com/
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw88/rx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/rx.c b/drivers/net/wireless/realtek/rtw88/rx.c
index 8b0afaaffaa0..41f6557d8d78 100644
--- a/drivers/net/wireless/realtek/rtw88/rx.c
+++ b/drivers/net/wireless/realtek/rtw88/rx.c
@@ -295,6 +295,14 @@ void rtw_rx_query_rx_desc(struct rtw_dev *rtwdev, void *rx_desc8,
 
 	pkt_stat->tsf_low = le32_get_bits(rx_desc->w5, RTW_RX_DESC_W5_TSFL);
 
+	if (pkt_stat->rate >= DESC_RATE_MAX) {
+		rtw_dbg(rtwdev, RTW_DBG_UNEXP,
+			"unexpected RX rate=0x%x\n", pkt_stat->rate);
+
+		pkt_stat->rate = DESC_RATE1M;
+		pkt_stat->bw = RTW_CHANNEL_WIDTH_20;
+	}
+
 	/* drv_info_sz is in unit of 8-bytes */
 	pkt_stat->drv_info_sz *= 8;
 

base-commit: eef6d4449e8a540fde792968a26d8aa514af8089
-- 
2.25.1

Re: [PATCH rtw-next] wifi: rtw88: validate RX rate to prevent out-of-bound

[LB F]

Ping-Ke Shih <pkshih@realtek.com> wrote:
> The reported RX rate might be unexpected, causing kernel warns:
>   Rate marked as a VHT rate but data is invalid: MCS: 0, NSS: 0
>   WARNING: net/mac80211/rx.c:5491 at ieee80211_rx_list+0x183/0x1020 [mac80211]
> As the RX rate can be index of an array under certain conditions, validate
> it to prevent accessing array out-of-bound potentially.

Tested on HP Notebook P3S95EA#ACB (kernel 6.19.9-1-cachyos):

  - No WARNING: net/mac80211/rx.c:5491 observed after patch.
  - System remains fully stable through idle, load, Bluetooth A2DP
    usage, and multiple suspend/resume cycles.
  - Zero h2c or lps errors in dmesg.

Tested-by: Oleksandr Havrylov <goainwo@gmail.com>

RE: [PATCH rtw-next] wifi: rtw88: validate RX rate to prevent out-of-bound

[Ping-Ke Shih]

LB F <goainwo@gmail.com> wrote:
> Ping-Ke Shih <pkshih@realtek.com> wrote:
> > The reported RX rate might be unexpected, causing kernel warns:
> >   Rate marked as a VHT rate but data is invalid: MCS: 0, NSS: 0
> >   WARNING: net/mac80211/rx.c:5491 at ieee80211_rx_list+0x183/0x1020
> [mac80211]
> > As the RX rate can be index of an array under certain conditions, validate
> > it to prevent accessing array out-of-bound potentially.
> 
> Tested on HP Notebook P3S95EA#ACB (kernel 6.19.9-1-cachyos):
> 
>   - No WARNING: net/mac80211/rx.c:5491 observed after patch.
>   - System remains fully stable through idle, load, Bluetooth A2DP
>     usage, and multiple suspend/resume cycles.
>   - Zero h2c or lps errors in dmesg.
> 
> Tested-by: Oleksandr Havrylov <goainwo@gmail.com>

Thanks for your test. As the change in data path, I'd add an unlikely()
by v2. Also, take your test info. If v2 doesn't work to you (I think
the result of v2 must be identical to v1), please NACK me by v2 patch
I will send out right away.

Ping-Ke