Commit ed2e4bb1 authored by Zong-Zhe Yang's avatar Zong-Zhe Yang Committed by Ping-Ke Shih
Browse files

wifi: rtw89: avoid reading out of bounds when loading TX power FW elements 



Because the loop-expression will do one more time before getting false from
cond-expression, the original code copied one more entry size beyond valid
region.

Fix it by moving the entry copy to loop-body.

Signed-off-by: default avatarZong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: default avatarPing-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20240902015803.20420-1-pkshih@realtek.com
parent c9ac071e

drivers/net/wireless/realtek/rtw89/core.h

+12 −6
Original line number Diff line number Diff line
@@ -3978,16 +3978,22 @@ struct rtw89_txpwr_conf { 
	const void *data;

};



static inline bool rtw89_txpwr_entcpy(void *entry, const void *cursor, u8 size,

				      const struct rtw89_txpwr_conf *conf)

{

	u8 valid_size = min(size, conf->ent_sz);



	memcpy(entry, cursor, valid_size);

	return true;

}



#define rtw89_txpwr_conf_valid(conf) (!!(conf)->data)



#define rtw89_for_each_in_txpwr_conf(entry, cursor, conf) \

	for (typecheck(const void *, cursor), (cursor) = (conf)->data, \

	     memcpy(&(entry), cursor, \

		    min_t(u8, sizeof(entry), (conf)->ent_sz)); \

	for (typecheck(const void *, cursor), (cursor) = (conf)->data; \

	     (cursor) < (conf)->data + (conf)->num_ents * (conf)->ent_sz; \

	     (cursor) += (conf)->ent_sz, \

	     memcpy(&(entry), cursor, \

		    min_t(u8, sizeof(entry), (conf)->ent_sz)))

	     (cursor) += (conf)->ent_sz) \

		if (rtw89_txpwr_entcpy(&(entry), cursor, sizeof(entry), conf))



struct rtw89_txpwr_byrate_data {

	struct rtw89_txpwr_conf conf;