linux-kernel - Re: Bug Report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fcd02348-804c-459b-aa03-de61931516be@bestosotech.com>
Date: Thu, 27 Nov 2025 01:55:33 -0500
From: alex bestoso <alexbestoso@...tosotech.com>
To: Ping-Ke Shih <pkshih@...ltek.com>
Cc: "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Bug Report - Rtlwifi

Never made a patch before; but I believe that this is correct, made with git

Sent as attachment and pasted below:


 From 523d3c06eee93db74125b17b5c883ad2c58fcbd5 Mon Sep 17 00:00:00 2001
From: Morning Star <alexbestoso@...il.com>
Date: Thu, 27 Nov 2025 01:49:39 -0500
Subject: [PATCH] check tid is less than MAX_TID_COUNT

---
  drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c 
b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
index aa702ba7c9f5..fbd9cebb717a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
      if (sta) {
          sta_entry = (struct rtl_sta_info *)sta->drv_priv;
          tid = ieee80211_get_tid(hdr);
-        agg_state = sta_entry->tids[tid].agg.agg_state;
+        if(tid < MAX_TID_COUNT)
+            agg_state = sta_entry->tids[tid].agg.agg_state;
          ampdu_density = sta->deflink.ht_cap.ampdu_density;
      }

-- 
2.34.1



On 11/27/25 01:37, Ping-Ke Shih wrote:
> alex bestoso <alexbestoso@...tosotech.com> wrote:
>> Bug Description :
>>      Index out of range. Problem happens on it's own after being connected to a network for a short while.
>>
>> Error message :
>>      UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30
>>      [  454.351041] index 10 is out of range for type 'rtl_tid_data [9]'
>>
>> Kernel Version :
>>      6.18.0-rc6+
>>
>> Suggested Solution:
>>      change the file drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c from
>>
>>      513     tid = ieee80211_get_tid(hdr);
>>      514     agg_state = sta_entry->tids[tid].agg.agg_state;
>>      515     ampdu_density = sta->deflink.ht_cap.ampdu_density;
>>
>>      to
>>
>>      513     tid = ieee80211_get_tid(hdr);
>>      514     if(tid < MAX_TID_COUNT)
>>      515         agg_state = sta_entry->tids[tid].agg.agg_state;
>>      516     ampdu_density = sta->deflink.ht_cap.ampdu_density;
> This change is fine to me. Can you send a patch?
>
View attachment "0001-check-tid-is-less-than-MAX_TID_COUNT.patch" of type "text/x-patch" (973 bytes)