diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-06-30 15:28:27 +0800 |
|---|---|---|
| committer | Ping-Ke Shih <pkshih@realtek.com> | 2026-07-03 11:52:52 +0800 |
| commit | 2aba608a86e9b099c9af2ea70b620552dee2b628 (patch) | |
| tree | 6882d8dffc1da62b575dda989f77fbfb75a97dbd | |
| parent | a8cddb62c573f28eef5f887a8f3156e8ee22776a (diff) | |
wifi: rtw89: fix HE extended capability length check
rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability
byte 10, but rejects only datalen values below 10. Byte 10 requires at
least 11 bytes.
Require datalen >= 11 before reading data[10].
Fixes: 8d540f9d2916 ("wifi: rtw89: disable 26-tone RU HE TB PPDU transmissions")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/2026063009025530.2-ccfa108-0024-wifi-rtw89-fix-HE-extended--pengpeng@iscas.ac.cn
| -rw-r--r-- | drivers/net/wireless/realtek/rtw89/mac.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c index 8c395517bd2f..99de1b202976 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.c +++ b/drivers/net/wireless/realtek/rtw89/mac.c @@ -5167,7 +5167,7 @@ static void rtw89_mac_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy, elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data, ies->len); - if (!elem || elem->datalen < 10 || + if (!elem || elem->datalen < 11 || !(elem->data[10] & WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) *tolerated = false; rcu_read_unlock(); |