[PATCH] wifi: rtw88: sdio: check packet length against remaining RX data

[Noah Weinberger]

Hello,

rtw_sdio_rxfifo_recv() validates the descriptor's pkt_len only against
the absolute maximum (11454), never against the amount of data actually
transferred (rx_len). The last-packet branch is taken precisely when
curr_pkt_len + pkt_desc_sz >= rx_len - which includes the case where the
descriptor *overshoots* the buffer - and rtw_sdio_rx_skb() then calls
skb_put(skb, pkt_stat.pkt_len) on a buffer allocated for the aligned
rx_len.

The loop's own comment documents that the 8051-class chips can produce
packets whose pkt_len is zero or points beyond the end of the buffer
when the RX fill race hits; pkt_len == 0 is guarded, the overshoot is
not. An inconsistent descriptor therefore reaches skb_over_panic() ->
BUG.

Drop the frame instead when pkt_offset + pkt_len exceeds the remaining
rx_len.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), drivers/net/wireless/realtek/rtw88/sdio.c:1352-1419 (rtw_sdio_rxfifo_recv), sdio.c:1331-1350 (rtw_sdio_rx_skb), rx.c:295-320 (rtw_rx_query_rx_desc).
Loop predates this window (8703B); newly reachable via 8723BS support added in this window.

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@xxxxxxxxx>
---
diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
index dc2fd0f..0a07d8d 100644
--- a/drivers/net/wireless/realtek/rtw88/sdio.c
+++ b/drivers/net/wireless/realtek/rtw88/sdio.c
@@ -1389,6 +1389,15 @@ static void rtw_sdio_rxfifo_recv(struct rtw_dev *rtwdev, u32 rx_len)
 		curr_pkt_len = ALIGN(pkt_offset + pkt_stat.pkt_len,
 				     RTW_SDIO_DATA_PTR_ALIGN);
 
+		/* The device may provide an inconsistent descriptor whose
+		 * packet length points beyond the received data; do not let
+		 * skb_put() run past the allocation in that case.
+		 */
+		if (pkt_offset + pkt_stat.pkt_len > rx_len) {
+			dev_kfree_skb_any(skb);
+			break;
+		}
+
 		if ((curr_pkt_len + pkt_desc_sz) >= rx_len) {
 			/* Use the original skb (with it's adjusted offset)
 			 * when processing the last (or even the only) entry to