[PATCH rtw-next 07/15] wifi: rtw89: fw: cmd_ofld_flush always reset counter
From: Ping-Ke Shih <pkshih@realtek.com>
Date: 2026-09-09 07:01:16
Subsystem:
realtek wireless driver (rtw89), the rest · Maintainers:
Ping-Ke Shih, Linus Torvalds
From: Zong-Zhe Yang <redacted> Callers expect cmd offload counter is reset after flushing, and then use counter++ with array index. Previously, it might cause OOB since cmd_ofld_flush gets an error, e.g out of memory, and does not reset the cmd offload counter. Fix cmd_ofld_flush to always reset it. Resolve OVERRUN (Out-of-bounds write) reported by Coverity. Pass info to cmd_ofld_flush to make Coverity aware the changes on cmd offload counter. Signed-off-by: Zong-Zhe Yang <redacted> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> --- drivers/net/wireless/realtek/rtw89/fw.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index a16127b2c317..dcbdf4b5e4b2 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c@@ -12643,9 +12643,9 @@ static int rtw89_fw_cmd_ofld_pack(struct rtw89_dev *rtwdev) return 0; } -static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev) +static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev, + struct rtw89_fw_cmd_ofld_info *info) { - struct rtw89_fw_cmd_ofld_info *info = rtwdev->fw_cmd_ofld_info; struct sk_buff *skb; int ret; u32 len;
@@ -12654,7 +12654,7 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev) skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len); if (!skb) { rtw89_err(rtwdev, "alloc skb fail\n"); - return; + goto out; } skb_put_data(skb, info->cmds, len);
@@ -12669,12 +12669,13 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev) if (ret) { rtw89_err(rtwdev, "failed to send cmd ofld\n"); dev_kfree_skb_any(skb); - return; + goto out; } if (info->accu_delay) fsleep(info->accu_delay); +out: info->cnt = 0; info->accu_delay = 0; }
@@ -12694,7 +12695,7 @@ static int rtw89_fw_cmd_ofld_unpack(struct rtw89_dev *rtwdev) if (info->cnt == 0) return 0; - rtw89_fw_cmd_ofld_flush(rtwdev); + rtw89_fw_cmd_ofld_flush(rtwdev, info); return 0; }
@@ -12721,7 +12722,7 @@ static int rtw89_fw_cmd_ofld_enqueue(struct rtw89_dev *rtwdev, return -EFAULT; if (info->cnt >= ARRAY_SIZE(info->cmds)) - rtw89_fw_cmd_ofld_flush(rtwdev); + rtw89_fw_cmd_ofld_flush(rtwdev, info); h2c = &info->cmds[info->cnt++];
--
2.25.1