From 03dd0d49de7db680a856fa566963bb8421f46368 Mon Sep 17 00:00:00 2001

From: Deren Wu <deren.wu@mediatek.com>

Date: Sun, 27 Nov 2022 10:35:37 +0800

Subject: [PATCH] wifi: mt76: fix coverity overrun-call in mt76_get_txpower()

Git-commit: 03dd0d49de7db680a856fa566963bb8421f46368

Patch-mainline: v6.2-rc1

References: git-fixes

Make sure the nss is valid for nss_delta array. Return zero

if the index is invalid.

Coverity message:

Event overrun-call: Overrunning callee's array of size 4 by passing

argument "n_chains" (which evaluates to 15) in call to

"mt76_tx_power_nss_delta".

int delta = mt76_tx_power_nss_delta(n_chains);

Fixes: 07cda406308b ("mt76: fix rounding issues on converting per-chain and combined txpower")

Signed-off-by: Deren Wu <deren.wu@mediatek.com>

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/net/wireless/mediatek/mt76/mt76.h | 3 ++-

 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h

index 33f87e518d68..32a77a0ae9da 100644

--- a/drivers/net/wireless/mediatek/mt76/mt76.h

+++ b/drivers/net/wireless/mediatek/mt76/mt76.h

@@ -1110,8 +1110,9 @@ static inline bool mt76_is_skb_pktid(u8 pktid)

 static inline u8 mt76_tx_power_nss_delta(u8 nss)

 {

 	static const u8 nss_delta[4] = { 0, 6, 9, 12 };

+	u8 idx = nss - 1;

-	return nss_delta[nss - 1];

+	return (idx < ARRAY_SIZE(nss_delta)) ? nss_delta[idx] : 0;

 }

 static inline bool mt76_testmode_enabled(struct mt76_phy *phy)

-- 

2.35.3