* Re: Bug Report - Rtlwifi
2025-11-27 6:37 ` Bug Report - Rtlwifi Ping-Ke Shih
@ 2025-11-27 6:55 ` alex bestoso
2025-11-27 7:50 ` Ping-Ke Shih
0 siblings, 1 reply; 4+ messages in thread
From: alex bestoso @ 2025-11-27 6:55 UTC (permalink / raw)
To: Ping-Ke Shih; +Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
[-- Attachment #1: Type: text/plain, Size: 2249 bytes --]
Never made a patch before; but I believe that this is correct, made with git
Sent as attachment and pasted below:
From 523d3c06eee93db74125b17b5c883ad2c58fcbd5 Mon Sep 17 00:00:00 2001
From: Morning Star <alexbestoso@gmail.com>
Date: Thu, 27 Nov 2025 01:49:39 -0500
Subject: [PATCH] check tid is less than MAX_TID_COUNT
---
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
index aa702ba7c9f5..fbd9cebb717a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
if (sta) {
sta_entry = (struct rtl_sta_info *)sta->drv_priv;
tid = ieee80211_get_tid(hdr);
- agg_state = sta_entry->tids[tid].agg.agg_state;
+ if(tid < MAX_TID_COUNT)
+ agg_state = sta_entry->tids[tid].agg.agg_state;
ampdu_density = sta->deflink.ht_cap.ampdu_density;
}
--
2.34.1
On 11/27/25 01:37, Ping-Ke Shih wrote:
> alex bestoso <alexbestoso@bestosotech.com> wrote:
>> Bug Description :
>> Index out of range. Problem happens on it's own after being connected to a network for a short while.
>>
>> Error message :
>> UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30
>> [ 454.351041] index 10 is out of range for type 'rtl_tid_data [9]'
>>
>> Kernel Version :
>> 6.18.0-rc6+
>>
>> Suggested Solution:
>> change the file drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c from
>>
>> 513 tid = ieee80211_get_tid(hdr);
>> 514 agg_state = sta_entry->tids[tid].agg.agg_state;
>> 515 ampdu_density = sta->deflink.ht_cap.ampdu_density;
>>
>> to
>>
>> 513 tid = ieee80211_get_tid(hdr);
>> 514 if(tid < MAX_TID_COUNT)
>> 515 agg_state = sta_entry->tids[tid].agg.agg_state;
>> 516 ampdu_density = sta->deflink.ht_cap.ampdu_density;
> This change is fine to me. Can you send a patch?
>
[-- Attachment #2: 0001-check-tid-is-less-than-MAX_TID_COUNT.patch --]
[-- Type: text/x-patch, Size: 973 bytes --]
From 523d3c06eee93db74125b17b5c883ad2c58fcbd5 Mon Sep 17 00:00:00 2001
From: Morning Star <alexbestoso@gmail.com>
Date: Thu, 27 Nov 2025 01:49:39 -0500
Subject: [PATCH] check tid is less than MAX_TID_COUNT
---
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
index aa702ba7c9f5..fbd9cebb717a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
if (sta) {
sta_entry = (struct rtl_sta_info *)sta->drv_priv;
tid = ieee80211_get_tid(hdr);
- agg_state = sta_entry->tids[tid].agg.agg_state;
+ if(tid < MAX_TID_COUNT)
+ agg_state = sta_entry->tids[tid].agg.agg_state;
ampdu_density = sta->deflink.ht_cap.ampdu_density;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread