wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
Ping-Ke Shih
maintainerPATCH 1/1 wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
From: Zong-Zhe Yang <[email protected]>
Because the loop-expression will do one more time before getting false from cond-expression, the original code copied one more entry size beyond valid region.
Fix it by moving the entry copy to loop-body.
Signed-off-by Zong-Zhe Yang <[email protected]>
Signed-off-by Ping-Ke Shih <[email protected]>
--- drivers/net/wireless/realtek/rtw89/core.h | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtw89/core.h +12 -6
@@ -3970,16 +3970,22 @@ struct rtw89_txpwr_conf {const void *data; }; +static inline bool rtw89_txpwr_entcpy (void *entry,const void *cursor,u8 size, +const struct rtw89_txpwr_conf *conf) +{ +u8 valid_size =min (size, conf->ent_sz); + +memcpy (entry, cursor, valid_size); +return true; +} +#define rtw89_txpwr_conf_valid (conf) (!!(conf)->data)#define rtw89_for_each_in_txpwr_conf (entry, cursor, conf) \ - for (typecheck(const void *, cursor), (cursor) = (conf)->data, \ - memcpy(&(entry), cursor, \ - min_t(u8, sizeof(entry), (conf)->ent_sz)); \ + for (typecheck(const void *, cursor), (cursor) = (conf)->data; \ (cursor) < (conf)->data + (conf)->num_ents * (conf)->ent_sz; \ - (cursor) += (conf)->ent_sz, \ - memcpy(&(entry), cursor, \ - min_t(u8, sizeof(entry), (conf)->ent_sz))) + (cursor) += (conf)->ent_sz) \ + if (rtw89_txpwr_entcpy(&(entry), cursor, sizeof(entry), conf))struct rtw89_txpwr_byrate_data {struct rtw89_txpwr_conf conf;
Signature · 1 line
2.25.1
Ping-Ke Shih
maintainerQuoted 10 lines · Ping-Ke Shih
From: Zong-Zhe Yang <[email protected]>
Because the loop-expression will do one more time before getting false from cond-expression, the original code copied one more entry size beyond valid region.
Fix it by moving the entry copy to loop-body.
Signed-off-by Zong-Zhe Yang <[email protected]>Signed-off-by Ping-Ke Shih <[email protected]>
1 patch(es) applied to rtw-next branch of rtw.git, thanks.
ed2e4bb17a48 wifi: rtw89: avoid reading out of bounds when loading TX power FW elements