TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wifi: rtw89: avoid reading out of bounds when loading TX power FW elements

Browse Source 
Because the loop-expression will do one more time before getting false from
cond-expression, the original code copied one more entry size beyond valid
region.

Fix it by moving the entry copy to loop-body.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20240902015803.20420-1-pkshih@realtek.com
This commit is contained in:
Zong-Zhe Yang
2024-09-02 09:58:03 +08:00
committed by Ping-Ke Shih
parent c9ac071e30
commit ed2e4bb17a
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/net/wireless/realtek/rtw89/core.h
+12 -6
View File
@@ -3978,16 +3978,22 @@ struct rtw89_txpwr_conf {
const void *data;
};
static inline bool rtw89_txpwr_entcpy(void *entry, const void *cursor, u8 size,
const struct rtw89_txpwr_conf *conf)
{
u8 valid_size = min(size, conf->ent_sz);
memcpy(entry, cursor, valid_size);
return true;
}
#define rtw89_txpwr_conf_valid(conf) (!!(conf)->data)
#define rtw89_for_each_in_txpwr_conf(entry, cursor, conf) \
for (typecheck(const void *, cursor), (cursor) = (conf)->data, \
memcpy(&(entry), cursor, \
min_t(u8, sizeof(entry), (conf)->ent_sz)); \
for (typecheck(const void *, cursor), (cursor) = (conf)->data; \
(cursor) < (conf)->data + (conf)->num_ents * (conf)->ent_sz; \
(cursor) += (conf)->ent_sz, \
memcpy(&(entry), cursor, \
min_t(u8, sizeof(entry), (conf)->ent_sz)))
(cursor) += (conf)->ent_sz) \
if (rtw89_txpwr_entcpy(&(entry), cursor, sizeof(entry), conf))
struct rtw89_txpwr_byrate_data {
struct rtw89_txpwr_conf conf;