github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-02 11:33:28 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: rtw89: phy: fix out-of-bounds access in rtw89_phy_read_txpwr_limit()

Browse Source 
Coverity reported a potential out-of-bounds access when 'bw' exceeds the
valid range for the specified band. Add a helper `rtw89_bw_is_valid()`
to check bandwidth validity for each band before accessing limit tables.

Addresses-Coverity-ID: 1598844 ("Out-of-bounds access")
Addresses-Coverity-ID: 1598896 ("Out-of-bounds access")

Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251111022452.28093-6-pkshih@realtek.com
This commit is contained in:
Kuan-Chung Chen 2025-11-11 10:24:49 +08:00 committed by Ping-Ke Shih
parent b37fb77d45
commit 1dd7e743dd
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/net/wireless/realtek/rtw89/phy.c
View File

@ -2376,6 +2376,21 @@ static u8 rtw89_channel_to_idx(struct rtw89_dev *rtwdev, u8 band, u8 channel)
}
}
static bool rtw89_phy_validate_txpwr_limit_bw(struct rtw89_dev *rtwdev,
u8 band, u8 bw)
{
switch (band) {
case RTW89_BAND_2G:
return bw < RTW89_2G_BW_NUM;
case RTW89_BAND_5G:
return bw < RTW89_5G_BW_NUM;
case RTW89_BAND_6G:
return bw < RTW89_6G_BW_NUM;
default:
return false;
}
}
s8 rtw89_phy_read_txpwr_limit(struct rtw89_dev *rtwdev, u8 band,
u8 bw, u8 ntx, u8 rs, u8 bf, u8 ch)
{
@ -2400,6 +2415,11 @@ s8 rtw89_phy_read_txpwr_limit(struct rtw89_dev *rtwdev, u8 band,
};
s8 cstr;
if (!rtw89_phy_validate_txpwr_limit_bw(rtwdev, band, bw)) {
rtw89_warn(rtwdev, "invalid band %u bandwidth %u\n", band, bw);
return 0;
}
switch (band) {
case RTW89_BAND_2G:
if (has_ant_gain)