Re: [PATCH RESEND rtw-next v2 1/2] wifi: rtw88: 8822c: fix out-of-bounds access in cck_pd_set

[Zeshan Ahmed Nobin <zeshanahmednobin@gmail.com>]

Hi Luka,

On Mon, Nov 09, 2026 at 07:41:46 +0100, Luka Gejak wrote:
> As far as I can see bw doesn't have to come from the chip here, since
> rtw_set_channel() programs the same value it stores in hal. So maybe
> this could just be
>
>         bw = rtwdev->hal.current_band_width;
>
> CCK PD only runs on 2.4 GHz, so that seems to always be 20 or 40 MHz and
> the check could go. Or is there a reason to read it from the chip that I
> missed?

I couldn't find one. Apart from the BB init table, bits 3:2 of 0x9b0
are only written by rtw8822c_set_channel_bb(), with the bandwidth that
rtw_set_channel() also stores in hal. I also checked it on my
RTL8822CE with Ubuntu's 6.8 kernel. Its firmware does hardware scans,
and at 40 MHz on 2.4 GHz, hal and the register matched at every
cck_pd_set call, across 10 scans and a reconnect. So v3 will take bw
from hal and drop the check.

One consequence: a chip that drops off the PCIe bus still reads nrx
back as 3. When the level then changes, rtw8822c_phy_cck_pd_set_reg()
gets past its WARN_ON(), since bw is now valid, and does the zero-mask
access to register 0x0; forcing nrx to 3 confirmed it. So on PCIe,
patch 2 is then what handles a dead chip. In v3 I'll update its
message for that and add Cc: stable to it as well. Its code doesn't
change; is it fine to keep your Reviewed-by on it?

Thanks,
Zeshan Ahmed Nobin