From: Ching-Te Ku The firmware report control structures store gnt_val as either struct rtw89_mac_ax_gnt or a u8[4] array, so each element is four bytes wide. The destination dm->gnt_val[] uses struct rtw89_btc_gnt_ctrl, which is eight bytes. Copying sizeof(dm->gnt_val[i]) therefore read four bytes past the end of every source element on each loop iteration, across all affected report versions. Bound the copy by the size of the source element instead, so the memcpy never reads beyond the report field. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih --- drivers/net/wireless/realtek/rtw89/coex.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c index 3ef30bd962d9..f86311191171 100644 --- a/drivers/net/wireless/realtek/rtw89/coex.c +++ b/drivers/net/wireless/realtek/rtw89/coex.c @@ -2050,7 +2050,7 @@ static u32 _chk_btc_report(struct rtw89_dev *rtwdev, for (i = RTW89_PHY_0; i < RTW89_PHY_NUM; i++) memcpy(&dm->gnt_val[i], &prpt->v4.gnt_val[i], - sizeof(dm->gnt_val[i])); + sizeof(prpt->v4.gnt_val[i])); bt->bcnt[BTC_BCNT_HIPRI_TX] = le32_to_cpu(prpt->v4.bt_cnt[BTC_BCNT_HI_TX]); @@ -2082,7 +2082,7 @@ static u32 _chk_btc_report(struct rtw89_dev *rtwdev, for (i = RTW89_PHY_0; i < RTW89_PHY_NUM; i++) memcpy(&dm->gnt_val[i], &prpt->v5.gnt_val[i], - sizeof(dm->gnt_val[i])); + sizeof(prpt->v5.gnt_val[i])); bt->bcnt[BTC_BCNT_HIPRI_TX] = le16_to_cpu(prpt->v5.bt_cnt[BTC_BCNT_HI_TX]); @@ -2109,7 +2109,7 @@ static u32 _chk_btc_report(struct rtw89_dev *rtwdev, for (i = RTW89_PHY_0; i < RTW89_PHY_NUM; i++) memcpy(&dm->gnt_val[i], &prpt->v105.gnt_val[i], - sizeof(dm->gnt_val[i])); + sizeof(prpt->v105.gnt_val[i])); bt->bcnt[BTC_BCNT_HIPRI_TX] = le16_to_cpu(prpt->v105.bt_cnt[BTC_BCNT_HI_TX_V105]); @@ -2135,7 +2135,7 @@ static u32 _chk_btc_report(struct rtw89_dev *rtwdev, for (i = RTW89_PHY_0; i < RTW89_PHY_NUM; i++) memcpy(&dm->gnt_val[i], &prpt->v7.gnt_val[i], - sizeof(dm->gnt_val[i])); + sizeof(prpt->v7.gnt_val[i])); bt->bcnt[BTC_BCNT_HIPRI_TX] = le16_to_cpu(prpt->v7.bt_cnt[BTC_BCNT_HI_TX_V105]); @@ -2167,7 +2167,7 @@ static u32 _chk_btc_report(struct rtw89_dev *rtwdev, for (i = RTW89_PHY_0; i < RTW89_PHY_NUM; i++) memcpy(&dm->gnt_val[i], &prpt->v8.gnt_val[i], - sizeof(dm->gnt_val[i])); + sizeof(prpt->v8.gnt_val[i])); bt->bcnt[BTC_BCNT_HIPRI_TX] = le16_to_cpu(prpt->v8.bt_cnt[BTC_BCNT_HI_TX_V105]); @@ -2212,7 +2212,7 @@ static u32 _chk_btc_report(struct rtw89_dev *rtwdev, for (i = RTW89_PHY_0; i < RTW89_PHY_NUM; i++) memcpy(&dm->gnt_val[i], &prpt->v9.gnt_val[i], - sizeof(dm->gnt_val[i])); + sizeof(prpt->v9.gnt_val[i])); bt->bcnt[BTC_BCNT_HIPRI_TX] = le16_to_cpu(prpt->v9.bt_cnt[BTC_BCNT_HI_TX_V105]); -- 2.25.1