Re: Bug Report - Rtlwifi

[alex bestoso]

Never made a patch before; but I believe that this is correct, made with git

Sent as attachment and pasted below:


From 523d3c06eee93db74125b17b5c883ad2c58fcbd5 Mon Sep 17 00:00:00 2001
From: Morning Star <alexbestoso@xxxxxxxxx>
Date: Thu, 27 Nov 2025 01:49:39 -0500
Subject: [PATCH] check tid is less than MAX_TID_COUNT

---
 drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c 
b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
index aa702ba7c9f5..fbd9cebb717a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
     if (sta) {
         sta_entry = (struct rtl_sta_info *)sta->drv_priv;
         tid = ieee80211_get_tid(hdr);
-        agg_state = sta_entry->tids[tid].agg.agg_state;
+        if(tid < MAX_TID_COUNT)
+            agg_state = sta_entry->tids[tid].agg.agg_state;
         ampdu_density = sta->deflink.ht_cap.ampdu_density;
     }

--
2.34.1



On 11/27/25 01:37, Ping-Ke Shih wrote:
> alex bestoso <alexbestoso@xxxxxxxxxxxxxxx> wrote:
> > Bug Description :
> >      Index out of range. Problem happens on it's own after being connected to a network for a short while.
> >
> > Error message :
> >      UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30
> >      [  454.351041] index 10 is out of range for type 'rtl_tid_data [9]'
> >
> > Kernel Version :
> >      6.18.0-rc6+
> >
> > Suggested Solution:
> >      change the file drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c from
> >
> >      513     tid = ieee80211_get_tid(hdr);
> >      514     agg_state = sta_entry->tids[tid].agg.agg_state;
> >      515     ampdu_density = sta->deflink.ht_cap.ampdu_density;
> >
> >      to
> >
> >      513     tid = ieee80211_get_tid(hdr);
> >      514     if(tid < MAX_TID_COUNT)
> >      515         agg_state = sta_entry->tids[tid].agg.agg_state;
> >      516     ampdu_density = sta->deflink.ht_cap.ampdu_density;
> This change is fine to me. Can you send a patch?
From 523d3c06eee93db74125b17b5c883ad2c58fcbd5 Mon Sep 17 00:00:00 2001
From: Morning Star <alexbestoso@xxxxxxxxx>
Date: Thu, 27 Nov 2025 01:49:39 -0500
Subject: [PATCH] check tid is less than MAX_TID_COUNT

---
 drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
index aa702ba7c9f5..fbd9cebb717a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
 	if (sta) {
 		sta_entry = (struct rtl_sta_info *)sta->drv_priv;
 		tid = ieee80211_get_tid(hdr);
-		agg_state = sta_entry->tids[tid].agg.agg_state;
+		if(tid < MAX_TID_COUNT)
+			agg_state = sta_entry->tids[tid].agg.agg_state;
 		ampdu_density = sta->deflink.ht_cap.ampdu_density;
 	}
 
-- 
2.34.1