rtw89: coex: correct C2H header length

To resolve C2H handle length mismatch, or it will parse the c2h content
out of array.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20211209083229.10815-2-pkshih@realtek.com

diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
index abe4b6549ab228444fd5029401232b9762037370..f220229a7a4821ee60bb46ac5a5c27ac6d875813 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/coex.c
+++ b/drivers/net/wireless/realtek/rtw89/coex.c
@@ -4494,6 +4494,8 @@ void rtw89_btc_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb,
        struct rtw89_btc_btf_fwinfo *pfwinfo = &btc->fwinfo;
        u8 *buf = &skb->data[RTW89_C2H_HEADER_LEN];
 
+       len -= RTW89_C2H_HEADER_LEN;
+
        rtw89_debug(rtwdev, RTW89_DBG_BTC,
                    "[BTC], %s(): C2H BT len:%d class:%d fun:%d\n",
                    __func__, len, class, func);