From: Ping-Ke Shih <pkshih@realtek.com>
To: Bitterblue Smith <rtl8821cerfe2@gmail.com>,
"linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Cc: LB F <goainwo@gmail.com>,
Martin Blumenstingl <martin.blumenstingl@googlemail.com>,
Fiona Klute <fiona.klute@gmx.de>,
"andrej.skvortzov@gmail.com" <andrej.skvortzov@gmail.com>,
"anarsoul@gmail.com" <anarsoul@gmail.com>,
Zhen XIN <zhen.xin@nokia-sbell.com>
Subject: RE: [PATCH rtw-next v2] wifi: rtw88: Add more validation for the RX descriptor
Date: Thu, 21 May 2026 00:50:27 +0000 [thread overview]
Message-ID: <ce31120c297642c7a49eb468d43dd277@realtek.com> (raw)
In-Reply-To: <5bfecba3-8a90-4e0f-9558-af5cd8a14975@gmail.com>
Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> Some RTL8821CE cards can return frames with corrupted RX descriptor,
> causing warnings and crashes if they are passed to the upper layers.
>
> The PHY status size field is 4 bits wide, but in rtw88 its value should
> only be 0 or 4. Checking this catches most of the corrupt frames.
>
> If a PHY status is present, the PHY status size should not be 0.
>
> The frame size should not be less than or equal to 4 and should not
> exceed 11454.
>
> The rate should not exceed 4SS MCS9.
>
> Discard the frame if any of these checks fail.
>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221286
> Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
next prev parent reply other threads:[~2026-05-21 0:51 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-20 14:14 [PATCH rtw-next v2] wifi: rtw88: Add more validation for the RX descriptor Bitterblue Smith
2026-05-20 15:48 ` Oleksandr Havrylov
2026-05-21 0:50 ` Ping-Ke Shih [this message]
2026-05-27 8:46 ` Ping-Ke Shih
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ce31120c297642c7a49eb468d43dd277@realtek.com \
--to=pkshih@realtek.com \
--cc=anarsoul@gmail.com \
--cc=andrej.skvortzov@gmail.com \
--cc=fiona.klute@gmx.de \
--cc=goainwo@gmail.com \
--cc=linux-wireless@vger.kernel.org \
--cc=martin.blumenstingl@googlemail.com \
--cc=rtl8821cerfe2@gmail.com \
--cc=zhen.xin@nokia-sbell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox