Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> The "link_id" value comes from the user via debugfs. If it's larger
> than BITS_PER_LONG then that would result in shift wrapping and
> potentially an out of bounds access later. In fact, we can limit it
> to IEEE80211_MLD_MAX_NUM_LINKS (15).
>
> Fortunately, only root can write to debugfs files so the security
> impact is minimal.
>
> Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Reviewed-by: Zong-Zhe Yang <kevin_yang@xxxxxxxxxxx>
1 patch(es) applied to rtw-next branch of rtw.git, thanks.
53cf488927a0 wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()
---
https://github.com/pkshih/rtw.git
