From: Zong-Zhe Yang Callers expect cmd offload counter is reset after flushing, and then use counter++ with array index. Previously, it might cause OOB since cmd_ofld_flush gets an error, e.g out of memory, and does not reset the cmd offload counter. Fix cmd_ofld_flush to always reset it. Resolve OVERRUN (Out-of-bounds write) reported by Coverity. Pass info to cmd_ofld_flush to make Coverity aware the changes on cmd offload counter. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih --- drivers/net/wireless/realtek/rtw89/fw.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index a16127b2c317..dcbdf4b5e4b2 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -12643,9 +12643,9 @@ static int rtw89_fw_cmd_ofld_pack(struct rtw89_dev *rtwdev) return 0; } -static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev) +static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev, + struct rtw89_fw_cmd_ofld_info *info) { - struct rtw89_fw_cmd_ofld_info *info = rtwdev->fw_cmd_ofld_info; struct sk_buff *skb; int ret; u32 len; @@ -12654,7 +12654,7 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev) skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len); if (!skb) { rtw89_err(rtwdev, "alloc skb fail\n"); - return; + goto out; } skb_put_data(skb, info->cmds, len); @@ -12669,12 +12669,13 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev) if (ret) { rtw89_err(rtwdev, "failed to send cmd ofld\n"); dev_kfree_skb_any(skb); - return; + goto out; } if (info->accu_delay) fsleep(info->accu_delay); +out: info->cnt = 0; info->accu_delay = 0; } @@ -12694,7 +12695,7 @@ static int rtw89_fw_cmd_ofld_unpack(struct rtw89_dev *rtwdev) if (info->cnt == 0) return 0; - rtw89_fw_cmd_ofld_flush(rtwdev); + rtw89_fw_cmd_ofld_flush(rtwdev, info); return 0; } @@ -12721,7 +12722,7 @@ static int rtw89_fw_cmd_ofld_enqueue(struct rtw89_dev *rtwdev, return -EFAULT; if (info->cnt >= ARRAY_SIZE(info->cmds)) - rtw89_fw_cmd_ofld_flush(rtwdev); + rtw89_fw_cmd_ofld_flush(rtwdev, info); h2c = &info->cmds[info->cnt++]; -- 2.25.1