From: Zong-Zhe Yang The array size is 14. Add a check to avoid out-of-bound access. Although it doesn't seem to happen if everything follows spec., it might have potential problem in pure logic. Resolve OVERRUN (Out-of-bounds access) reported by Coverity. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih --- drivers/net/wireless/realtek/rtw89/rtw8852a.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c index 5d7b5d1a24b1..4b364f039464 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c @@ -945,6 +945,14 @@ static int rtw8852a_ctrl_sco_cck(struct rtw89_dev *rtwdev, u8 central_ch, rtw89_warn(rtwdev, "Invalid BW:%d for CCK\n", bw); return -EINVAL; } + + if (unlikely(ch_element >= 14)) { + rtw89_warn(rtwdev, + "Invalid ch_element:%u where central_ch %u primary_ch %u\n", + ch_element, central_ch, primary_ch); + return -EINVAL; + } + rtw89_phy_write32_mask(rtwdev, R_RXSCOBC, B_RXSCOBC_TH, rtw8852a_sco_barker_threshold[ch_element]); rtw89_phy_write32_mask(rtwdev, R_RXSCOCCK, B_RXSCOCCK_TH, -- 2.25.1