In the rtw_pci_init_rx_ring function the "if (len > TRX_BD_IDX_MASK)" statement guarantees that len is less than or equal to GENMASK(11, 0) or in other words that len is less than or equal to 4095. However the rx_ring->buf has a size of RTK_MAX_RX_DESC_NUM (defined as 512). This way it is possible an out-of-bounds write in the for statement due to the i variable can exceed the rx_ring->buff size.
However, this overflow never happens due to the rtw_pci_init_rx_ring is only ever called with a fixed constant of RTK_MAX_RX_DESC_NUM. But it is better to be defensive in this case and add a new check to avoid overflows if this function is called in a future with a value greater than 512.
Cc: stable@vger.kernel.org Addresses-Coverity-ID: 1461515 ("Out-of-bounds write") Fixes: e3037485c68ec ("rtw88: new Realtek 802.11ac driver") Signed-off-by: Len Baker len.baker@gmx.com --- Changelog v1 -> v2 - Remove the macro ARRAY_SIZE from the for loop (Pkshih, Brian Norris). - Add a new check for the len variable (Pkshih, Brian Norris).
drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c index e7d17ab8f113..53dc90276693 100644 --- a/drivers/net/wireless/realtek/rtw88/pci.c +++ b/drivers/net/wireless/realtek/rtw88/pci.c @@ -273,6 +273,11 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev, return -EINVAL; }
+ if (len > ARRAY_SIZE(rx_ring->buf)) { + rtw_err(rtwdev, "len %d exceeds maximum RX ring buffer\n", len); + return -EINVAL; + } + head = dma_alloc_coherent(&pdev->dev, ring_sz, &dma, GFP_KERNEL); if (!head) { rtw_err(rtwdev, "failed to allocate rx ring\n"); -- 2.25.1