From: Deren Wu Date: Sun, 27 Nov 2022 02:35:37 +0000 (+0800) Subject: wifi: mt76: fix coverity overrun-call in mt76_get_txpower() X-Git-Tag: v6.2-rc1~99^2~77^2~2^2~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=03dd0d49de7db680a856fa566963bb8421f46368;p=thirdparty%2Fkernel%2Flinux.git wifi: mt76: fix coverity overrun-call in mt76_get_txpower() Make sure the nss is valid for nss_delta array. Return zero if the index is invalid. Coverity message: Event overrun-call: Overrunning callee's array of size 4 by passing argument "n_chains" (which evaluates to 15) in call to "mt76_tx_power_nss_delta". int delta = mt76_tx_power_nss_delta(n_chains); Fixes: 07cda406308b ("mt76: fix rounding issues on converting per-chain and combined txpower") Signed-off-by: Deren Wu Signed-off-by: Felix Fietkau --- diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h index 33f87e518d68e..32a77a0ae9da9 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76.h +++ b/drivers/net/wireless/mediatek/mt76/mt76.h @@ -1110,8 +1110,9 @@ static inline bool mt76_is_skb_pktid(u8 pktid) static inline u8 mt76_tx_power_nss_delta(u8 nss) { static const u8 nss_delta[4] = { 0, 6, 9, 12 }; + u8 idx = nss - 1; - return nss_delta[nss - 1]; + return (idx < ARRAY_SIZE(nss_delta)) ? nss_delta[idx] : 0; } static inline bool mt76_testmode_enabled(struct mt76_phy *phy)