From: Jiajia Liu Date: Wed, 20 May 2026 02:15:00 +0000 (+0800) Subject: Bluetooth: btmtk: remove extra copy in cmd array init X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ddb249341df3779c3c5cbe407b196f39921e1c53;p=thirdparty%2Flinux.git Bluetooth: btmtk: remove extra copy in cmd array init In btmtk_setup_firmware_79xx, the data length indicated by wmt_params.dlen in the cmd buffer is MTK_SEC_MAP_NEED_SEND_SIZE + 1. Except for the first byte, the remaining length is MTK_SEC_MAP_NEED_SEND_SIZE. memcpy copied one more byte to cmd + 1 than the remaining length. Align the length passed to memcpy to avoid exceeding current section map. Signed-off-by: Jiajia Liu Signed-off-by: Luiz Augusto von Dentz --- diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index ea7a031000cd..53cba71cb07f 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -188,7 +188,7 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname, MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i + MTK_SEC_MAP_COMMON_SIZE, - MTK_SEC_MAP_NEED_SEND_SIZE + 1); + MTK_SEC_MAP_NEED_SEND_SIZE); wmt_params.op = BTMTK_WMT_PATCH_DWNLD; wmt_params.status = &status;