[PATCH rtw-next 06/15] wifi: rtw89: 8852a: prevent potential OOB in ctrl_sco_cck
From: Ping-Ke Shih <pkshih@realtek.com>
Date: 2026-09-09 07:01:17
Subsystem:
realtek wireless driver (rtw89), the rest · Maintainers:
Ping-Ke Shih, Linus Torvalds
From: Zong-Zhe Yang <redacted> The array size is 14. Add a check to avoid out-of-bound access. Although it doesn't seem to happen if everything follows spec., it might have potential problem in pure logic. Resolve OVERRUN (Out-of-bounds access) reported by Coverity. Signed-off-by: Zong-Zhe Yang <redacted> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> --- drivers/net/wireless/realtek/rtw89/rtw8852a.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
index 5d7b5d1a24b1..4b364f039464 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c@@ -945,6 +945,14 @@ static int rtw8852a_ctrl_sco_cck(struct rtw89_dev *rtwdev, u8 central_ch, rtw89_warn(rtwdev, "Invalid BW:%d for CCK\n", bw); return -EINVAL; } + + if (unlikely(ch_element >= 14)) { + rtw89_warn(rtwdev, + "Invalid ch_element:%u where central_ch %u primary_ch %u\n", + ch_element, central_ch, primary_ch); + return -EINVAL; + } + rtw89_phy_write32_mask(rtwdev, R_RXSCOBC, B_RXSCOBC_TH, rtw8852a_sco_barker_threshold[ch_element]); rtw89_phy_write32_mask(rtwdev, R_RXSCOCCK, B_RXSCOCCK_TH,
--
2.25.1