Skip to contentSkip to conversation

wifi: rtw89: avoid reading out of bounds when loading TX power FW elements

PATCH In review Ping-Ke Shih 1 participant 2 messages Sep 2, 2024 – Sep 5, 2024 Realtek wireless driver (rtw89)

lore
Share & tools
lore

Ping-Ke Shih

author maintainer
#0 lore raw

PATCH 1/1 wifi: rtw89: avoid reading out of bounds when loading TX power FW elements

From: Zong-Zhe Yang <[email protected]>

Because the loop-expression will do one more time before getting false from cond-expression, the original code copied one more entry size beyond valid region.

Fix it by moving the entry copy to loop-body.

---
 drivers/net/wireless/realtek/rtw89/core.h | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtw89/core.h +12 -6
index 7c3aeedfd93a..4e8914218044 100644
@@ -3970,16 +3970,22 @@ struct rtw89_txpwr_conf {
 	const void *data;
 };
 
+static inline bool rtw89_txpwr_entcpy(void *entry, const void *cursor, u8 size,
+				      const struct rtw89_txpwr_conf *conf)
+{
+	u8 valid_size = min(size, conf->ent_sz);
+
+	memcpy(entry, cursor, valid_size);
+	return true;
+}
+
 #define rtw89_txpwr_conf_valid(conf) (!!(conf)->data)
 
 #define rtw89_for_each_in_txpwr_conf(entry, cursor, conf) \
-	for (typecheck(const void *, cursor), (cursor) = (conf)->data, \
-	     memcpy(&(entry), cursor, \
-		    min_t(u8, sizeof(entry), (conf)->ent_sz)); \
+	for (typecheck(const void *, cursor), (cursor) = (conf)->data; \
 	     (cursor) < (conf)->data + (conf)->num_ents * (conf)->ent_sz; \
-	     (cursor) += (conf)->ent_sz, \
-	     memcpy(&(entry), cursor, \
-		    min_t(u8, sizeof(entry), (conf)->ent_sz)))
+	     (cursor) += (conf)->ent_sz) \
+		if (rtw89_txpwr_entcpy(&(entry), cursor, sizeof(entry), conf))
 
 struct rtw89_txpwr_byrate_data {
 	struct rtw89_txpwr_conf conf;
Signature · 1 line
2.25.1
author maintainer
#1 lore raw
Quoted 10 lines · Ping-Ke Shih

From: Zong-Zhe Yang <[email protected]>

Because the loop-expression will do one more time before getting false from cond-expression, the original code copied one more entry size beyond valid region.

Fix it by moving the entry copy to loop-body.

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

ed2e4bb17a48 wifi: rtw89: avoid reading out of bounds when loading TX power FW elements

---
https://github.com/pkshih/rtw.git