Re: [PATCH RESEND rtw-next v2 1/2] wifi: rtw88: 8822c: fix out-of-bounds access in cck_pd_set

[Luka Gejak]

Hi Zeshan,

Thanks for the v2. One minor thing.

On November 8, 2026 7:28:36 PM GMT+01:00, Zeshan Ahmed Nobin
<zeshanahmednobin@xxxxxxxxx> wrote:

> diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
> index 09315d23e2c4..6343568285bc 100644
> --- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
> +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
> @@ -4406,6 +4406,13 @@ static void rtw8822c_phy_cck_pd_set(struct rtw_dev *rtwdev, u8 new_lvl)
>       nrx = (u8)rtw_read32_mask(rtwdev, 0x1a2c, 0x60000);
>       bw = (u8)rtw_read32_mask(rtwdev, 0x9b0, 0xc);
>
> +     /*
> +      * cck_pd_lv[] only has entries for 20 and 40 MHz. A chip that stops
> +      * responding on the PCIe bus reads back as all ones, giving bw = 3.
> +      */
> +     if (bw >= ARRAY_SIZE(dm_info->cck_pd_lv))
> +             return;

As far as I can see bw doesn't have to come from the chip here, since
rtw_set_channel() programs the same value it stores in hal. So maybe
this could just be

        bw = rtwdev->hal.current_band_width;

CCK PD only runs on 2.4 GHz, so that seems to always be 20 or 40 MHz and
the check could go. Or is there a reason to read it from the chip that I
missed?


Best regards,
Luka Gejak