Re: [PATCH wireless] wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

[Ping-Ke Shih]

Runyu Xiao <runyu.xiao@xxxxxxxxxx> wrote:

> rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID
> from the 802.11 header and then uses it as an index into
> sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID
> value, so the result can be in the range 0..15.
> 
> rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and
> MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the
> aggregation state array. Keep the default RTL_AGG_STOP state for
> out-of-range TIDs, matching rtl92cu_tx_fill_desc().
> 
> This issue was detected by our static analysis tool and confirmed by
> manual audit. UBSAN validation for the same bug pattern reports an
> array-index-out-of-bounds access with index 10 for type
> 'rtl_tid_data [9]'.
> 
> Fixes: 8321424134a4 ("wifi: rtlwifi: Add rtl8192du/trx.{c,h}")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

ed4f05d9f2f4 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

---
https://github.com/pkshih/rtw.git