Skip to contentSkip to conversation

wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

PATCH In review Dan Carpenter 3 participants 4 messages May 28, 2025 – Jun 10, 2025

Subsystems (2)
Kernel janitors Realtek wireless driver (rtw89)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH v2 1/1 wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).

Fortunately, only root can write to debugfs files so the security impact is minimal.

Fixes 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
Signed-off-by Dan Carpenter <[email protected]>

---
Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG. It's stricter and also more informative.

 drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/core.c +2 -1
index 49447668cbf3..3604a8e15df0 100644
@@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 	if (unlikely(!ieee80211_vif_is_mld(vif)))
 		return -EOPNOTSUPP;
 
-	if (unlikely(!(usable_links & BIT(link_id)))) {
+	if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
+		     !(usable_links & BIT(link_id)))) {
 		rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
 			   link_id);
 		return -ENOLINK;
Signature · 1 line
2.47.2
#1 lore raw
Quoted 32 lines · Dan Carpenter

The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).

Fortunately, only root can write to debugfs files so the security impact is minimal.

Fixes 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
Signed-off-by Dan Carpenter <[email protected]>

---
Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG. It's stricter and also more informative.

 drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/core.c +2 -1
index 49447668cbf3..3604a8e15df0 100644
@@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct
 rtw89_vif *rtwvif,
        if (unlikely(!ieee80211_vif_is_mld(vif)))
                return -EOPNOTSUPP;
 
-       if (unlikely(!(usable_links & BIT(link_id)))) {
+       if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
+                    !(usable_links & BIT(link_id)))) {
                rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
                           link_id);

                return -ENOLINK;
Quoted 2 lines

--
2.47.2

It looks good to me.
Thank you.

maintainer Reviewed-by Zong-Zhe Yang
#2 lore raw
Quoted 27 lines · Zong-Zhe Yang
Quoted 26 lines · Dan Carpenter

The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).

Fortunately, only root can write to debugfs files so the security impact is minimal.

Fixes 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
Signed-off-by Dan Carpenter <[email protected]>

---
Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG. It's stricter and also more informative.

 drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/core.c +0 -0
index 49447668cbf3..3604a8e15df0 100644
@@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct
 rtw89_vif *rtwvif,
        if (unlikely(!ieee80211_vif_is_mld(vif)))
                return -EOPNOTSUPP;
Quoted 11 lines
Quoted 8 lines
drivers/net/wireless/realtek/rtw89/core.c +2 -1
-       if (unlikely(!(usable_links & BIT(link_id)))) {
+       if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
+                    !(usable_links & BIT(link_id)))) {
                rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
                           link_id);

                return -ENOLINK;

--
2.47.2

It looks good to me.
Thank you.

I will add a tag during committing.

Reviewed-by Zong-Zhe Yang <[email protected]>
maintainer
#3 lore raw
In reply to Dan Carpenter
Quoted 11 lines · Dan Carpenter

The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).

Fortunately, only root can write to debugfs files so the security impact is minimal.

Fixes 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Zong-Zhe Yang <[email protected]>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

53cf488927a0 wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

---
https://github.com/pkshih/rtw.git