diff options
| author | Zong-Zhe Yang <kevin_yang@realtek.com> | 2024-09-02 04:58:03 +0300 |
|---|---|---|
| committer | Ping-Ke Shih <pkshih@realtek.com> | 2024-09-05 04:13:44 +0300 |
| commit | ed2e4bb17a4884cf29c3347353d8aabb7265b46c (patch) | |
| tree | faace1d1383a3f4542f2820643a26d3a373b8def /drivers/net/wireless/realtek | |
| parent | c9ac071e30ba4f2e770a0705564790502a7b931f (diff) | |
| download | linux-ed2e4bb17a4884cf29c3347353d8aabb7265b46c.tar.xz | |
wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
Because the loop-expression will do one more time before getting false from
cond-expression, the original code copied one more entry size beyond valid
region.
Fix it by moving the entry copy to loop-body.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20240902015803.20420-1-pkshih@realtek.com
Diffstat (limited to 'drivers/net/wireless/realtek')
| -rw-r--r-- | drivers/net/wireless/realtek/rtw89/core.h | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 4091c8838bc5..4ed9034fdb46 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -3978,16 +3978,22 @@ struct rtw89_txpwr_conf { const void *data; }; +static inline bool rtw89_txpwr_entcpy(void *entry, const void *cursor, u8 size, + const struct rtw89_txpwr_conf *conf) +{ + u8 valid_size = min(size, conf->ent_sz); + + memcpy(entry, cursor, valid_size); + return true; +} + #define rtw89_txpwr_conf_valid(conf) (!!(conf)->data) #define rtw89_for_each_in_txpwr_conf(entry, cursor, conf) \ - for (typecheck(const void *, cursor), (cursor) = (conf)->data, \ - memcpy(&(entry), cursor, \ - min_t(u8, sizeof(entry), (conf)->ent_sz)); \ + for (typecheck(const void *, cursor), (cursor) = (conf)->data; \ (cursor) < (conf)->data + (conf)->num_ents * (conf)->ent_sz; \ - (cursor) += (conf)->ent_sz, \ - memcpy(&(entry), cursor, \ - min_t(u8, sizeof(entry), (conf)->ent_sz))) + (cursor) += (conf)->ent_sz) \ + if (rtw89_txpwr_entcpy(&(entry), cursor, sizeof(entry), conf)) struct rtw89_txpwr_byrate_data { struct rtw89_txpwr_conf conf; |