From: Ching-Te Ku The rlink array is dimensioned [RTW89_BE_BTC_WL_MAX_ROLE_NUMBER] [RTW89_MAC_NUM], where rlink_id is the HW-band index selecting the second dimension. The guard rejected rlink_id only when it reached RTW89_BAND_NUM (3), but the array holds RTW89_MAC_NUM (2) entries, so rlink_id == 2 passed the check and led to out-of-bounds access when writing rlink[role_id][rlink_id], when scanning rlink[i][rlink_id] in the per-role loop, and inside _update_wl_mlo_info() where the same index reaches arrays sized by HW band. Reject rlink_id at RTW89_MAC_NUM so it matches the actual array size. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih --- drivers/net/wireless/realtek/rtw89/coex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c index f86311191171..279b75461fe2 100644 --- a/drivers/net/wireless/realtek/rtw89/coex.c +++ b/drivers/net/wireless/realtek/rtw89/coex.c @@ -7605,7 +7605,7 @@ static void _update_wl_info(struct rtw89_dev *rtwdev, struct rtw89_btc_wl_link_i u8 i, link_mode_ori; u32 role_map = 0; - if (role_id >= RTW89_BE_BTC_WL_MAX_ROLE_NUMBER || rlink_id >= RTW89_BAND_NUM) + if (role_id >= RTW89_BE_BTC_WL_MAX_ROLE_NUMBER || rlink_id >= RTW89_MAC_NUM) return; /* -- 2.25.1