[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <bb4bc20d9f7346edb013f123051fc490@realtek.com>
Date: Thu, 29 May 2025 02:21:39 +0000
From: Ping-Ke Shih <pkshih@...ltek.com>
To: Zong-Zhe Yang <kevin_yang@...ltek.com>,
Dan Carpenter
<dan.carpenter@...aro.org>
CC: "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>
Subject: RE: [PATCH v2 next] wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()
Zong-Zhe Yang <kevin_yang@...ltek.com> wrote:
> Dan Carpenter <dan.carpenter@...aro.org> wrote:
> >
> > The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then
> > that would result in shift wrapping and potentially an out of bounds access later. In fact, we
> > can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).
> >
> > Fortunately, only root can write to debugfs files so the security impact is minimal.
> >
> > Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
> > Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> > ---
> > Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG.
> > It's stricter and also more informative.
> >
> > drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/wireless/realtek/rtw89/core.c
> > b/drivers/net/wireless/realtek/rtw89/core.c
> > index 49447668cbf3..3604a8e15df0 100644
> > --- a/drivers/net/wireless/realtek/rtw89/core.c
> > +++ b/drivers/net/wireless/realtek/rtw89/core.c
> > @@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct
> > rtw89_vif *rtwvif,
> > if (unlikely(!ieee80211_vif_is_mld(vif)))
> > return -EOPNOTSUPP;
> >
> > - if (unlikely(!(usable_links & BIT(link_id)))) {
> > + if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
> > + !(usable_links & BIT(link_id)))) {
> > rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
> > link_id);
> > return -ENOLINK;
> > --
> > 2.47.2
>
> It looks good to me.
> Thank you.
I will add a tag during committing.
Reviewed-by: Zong-Zhe Yang <kevin_yang@...ltek.com>
Powered by blists - more mailing lists