Re: Bug Report - Rtlwifi

[alex bestoso <alexbestoso@bestosotech.com>]

[-- Attachment #1: Type: text/plain, Size: 2249 bytes --]

Never made a patch before; but I believe that this is correct, made with git

Sent as attachment and pasted below:


 From 523d3c06eee93db74125b17b5c883ad2c58fcbd5 Mon Sep 17 00:00:00 2001
From: Morning Star <alexbestoso@gmail.com>
Date: Thu, 27 Nov 2025 01:49:39 -0500
Subject: [PATCH] check tid is less than MAX_TID_COUNT

---
  drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c 
b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
index aa702ba7c9f5..fbd9cebb717a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
      if (sta) {
          sta_entry = (struct rtl_sta_info *)sta->drv_priv;
          tid = ieee80211_get_tid(hdr);
-        agg_state = sta_entry->tids[tid].agg.agg_state;
+        if(tid < MAX_TID_COUNT)
+            agg_state = sta_entry->tids[tid].agg.agg_state;
          ampdu_density = sta->deflink.ht_cap.ampdu_density;
      }

-- 
2.34.1



On 11/27/25 01:37, Ping-Ke Shih wrote:
> alex bestoso <alexbestoso@bestosotech.com> wrote:
>> Bug Description :
>>      Index out of range. Problem happens on it's own after being connected to a network for a short while.
>>
>> Error message :
>>      UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30
>>      [  454.351041] index 10 is out of range for type 'rtl_tid_data [9]'
>>
>> Kernel Version :
>>      6.18.0-rc6+
>>
>> Suggested Solution:
>>      change the file drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c from
>>
>>      513     tid = ieee80211_get_tid(hdr);
>>      514     agg_state = sta_entry->tids[tid].agg.agg_state;
>>      515     ampdu_density = sta->deflink.ht_cap.ampdu_density;
>>
>>      to
>>
>>      513     tid = ieee80211_get_tid(hdr);
>>      514     if(tid < MAX_TID_COUNT)
>>      515         agg_state = sta_entry->tids[tid].agg.agg_state;
>>      516     ampdu_density = sta->deflink.ht_cap.ampdu_density;
> This change is fine to me. Can you send a patch?
>

[-- Attachment #2: 0001-check-tid-is-less-than-MAX_TID_COUNT.patch --]
[-- Type: text/x-patch, Size: 973 bytes --]

From 523d3c06eee93db74125b17b5c883ad2c58fcbd5 Mon Sep 17 00:00:00 2001
From: Morning Star <alexbestoso@gmail.com>
Date: Thu, 27 Nov 2025 01:49:39 -0500
Subject: [PATCH] check tid is less than MAX_TID_COUNT

---
 drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
index aa702ba7c9f5..fbd9cebb717a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
 	if (sta) {
 		sta_entry = (struct rtl_sta_info *)sta->drv_priv;
 		tid = ieee80211_get_tid(hdr);
-		agg_state = sta_entry->tids[tid].agg.agg_state;
+		if(tid < MAX_TID_COUNT)
+			agg_state = sta_entry->tids[tid].agg.agg_state;
 		ampdu_density = sta->deflink.ht_cap.ampdu_density;
 	}
 
-- 
2.34.1