]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: rtw88: validate RX rate to prevent out-of-bound
authorPing-Ke Shih <pkshih@realtek.com>
Tue, 24 Mar 2026 01:10:01 +0000 (09:10 +0800)
committerPing-Ke Shih <pkshih@realtek.com>
Mon, 30 Mar 2026 01:50:46 +0000 (09:50 +0800)
commitbf14367719fa86f7c6922c64d37a2df347954c66
treecfee989008dd41ca311fd4df53b0ea4894438898
parent047cddf88c611e616d49a00311d4722e46286234
wifi: rtw88: validate RX rate to prevent out-of-bound

The reported RX rate might be unexpected, causing kernel warns:

  Rate marked as a VHT rate but data is invalid: MCS: 0, NSS: 0
  WARNING: net/mac80211/rx.c:5491 at ieee80211_rx_list+0x183/0x1020 [mac80211]

As the RX rate can be index of an array under certain conditions, validate
it to prevent accessing array out-of-bound potentially.

Tested on HP Notebook P3S95EA#ACB (kernel 6.19.9-1-cachyos):

  - No WARNING: net/mac80211/rx.c:5491 observed after the v2 patch.
The unexpected `NSS: 0, MCS: 0` VHT rate warnings are successfully
mitigated.
  - The system remains fully stable through prolonged idle periods,
high network load, active Bluetooth A2DP usage, and multiple deep
suspend/resume cycles.
  - Zero h2c timeouts or firmware lps state errors observed in dmesg.

Reported-by: Oleksandr Havrylov <goainwo@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/CALdGYqSMUPnPfW-_q1RgYr0_SjoXUejAaJJr-o+jpwCk1S7ndQ@mail.gmail.com/
Tested-by: Oleksandr Havrylov <goainwo@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260324011001.5742-1-pkshih@realtek.com
drivers/net/wireless/realtek/rtw88/rx.c