* [PATCH] wifi: rtw89: fix HE extended capability length check
@ 2026-06-30 7:28 Pengpeng Hou
2026-06-30 7:51 ` Ping-Ke Shih
0 siblings, 1 reply; 2+ messages in thread
From: Pengpeng Hou @ 2026-06-30 7:28 UTC (permalink / raw)
To: Ping-Ke Shih; +Cc: linux-wireless, linux-kernel, Pengpeng Hou
rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability
byte 10, but rejects only datalen values below 10. Byte 10 requires at
least 11 bytes.
Require datalen >= 11 before reading data[10].
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/net/wireless/realtek/rtw89/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 8c39551..99de1b2 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -5167,7 +5167,7 @@ static void rtw89_mac_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data,
ies->len);
- if (!elem || elem->datalen < 10 ||
+ if (!elem || elem->datalen < 11 ||
!(elem->data[10] & WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
*tolerated = false;
rcu_read_unlock();
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: [PATCH] wifi: rtw89: fix HE extended capability length check
2026-06-30 7:28 [PATCH] wifi: rtw89: fix HE extended capability length check Pengpeng Hou
@ 2026-06-30 7:51 ` Ping-Ke Shih
0 siblings, 0 replies; 2+ messages in thread
From: Ping-Ke Shih @ 2026-06-30 7:51 UTC (permalink / raw)
To: Pengpeng Hou; +Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:
> Sent: Tuesday, June 30, 2026 3:28 PM
> rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability
> byte 10, but rejects only datalen values below 10. Byte 10 requires at
> least 11 bytes.
>
> Require datalen >= 11 before reading data[10].
>
I'd add a Fixes tag:
Fixes: 8d540f9d2916 ("wifi: rtw89: disable 26-tone RU HE TB PPDU transmissions")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-30 7:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-30 7:28 [PATCH] wifi: rtw89: fix HE extended capability length check Pengpeng Hou
2026-06-30 7:51 ` Ping-Ke Shih
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox