From 71f756a4c064b0312f46617c20893ecc17c332e4 Mon Sep 17 00:00:00 2001 From: Alex Kazinsky Date: Thu, 15 Oct 2026 11:20:05 +0400 Subject: [PATCH] wifi: rsi: Skip TX aggregation setup for non-QoS frames When transmitting a non-QoS unicast frame to a station in AP mode, rsi_core_xmit() assigns IEEE80211_NONQOS_TID (16) to tid. The station lookup succeeds, allowing tid to index start_tx_aggr[], which has only IEEE80211_NUM_TIDS (16) elements. This causes an out-of-bounds read and, if the value read is zero, an out-of-bounds write. Only access the aggregation state for tids below IEEE80211_NUM_TIDS, excluding the non-QoS sentinel from TX aggregation setup. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 19844c0a9a19 ("rsi: data and managemet path changes for AP mode") Cc: stable@vger.kernel.org Signed-off-by: Alex Kazinsky Link: https://patch.msgid.link/20261015072010.742369-1-a.kazinsky@ideco.ru Signed-off-by: Johannes Berg --- drivers/net/wireless/rsi/rsi_91x_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c index ead4d4e04328..3281fc94e107 100644 --- a/drivers/net/wireless/rsi/rsi_91x_core.c +++ b/drivers/net/wireless/rsi/rsi_91x_core.c @@ -458,7 +458,7 @@ void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb) tx_params->sta_id = 0; } - if (rsta) { + if (rsta && tid < IEEE80211_NUM_TIDS) { /* Start aggregation if not done for this tid */ if (!rsta->start_tx_aggr[tid]) { rsta->start_tx_aggr[tid] = true;