RE: [PATCH] wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

[Ping-Ke Shih <pkshih@xxxxxxxxxxx>]

Alexey Kodanev <aleksei.kodanev@xxxxxxxxxxx> wrote:
> Set the size to 6 instead of 2, since 'para' array is passed to
> 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads
> 5 bytes:
> 
> void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
> {
>     ...
>     SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
>     SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
>     ...
>     SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));
> 
> Detected using the static analysis tool - Svace.
> Fixes: 4136214f7c46 ("rtw88: add BT co-existence support")
> Signed-off-by: Alexey Kodanev <aleksei.kodanev@xxxxxxxxxxx>
> ---
>  drivers/net/wireless/realtek/rtw88/coex.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c
> index c929db1e53ca..347807801270 100644
> --- a/drivers/net/wireless/realtek/rtw88/coex.c
> +++ b/drivers/net/wireless/realtek/rtw88/coex.c
> @@ -309,7 +309,7 @@ static void rtw_coex_tdma_timer_base(struct rtw_dev *rtwdev, u8 type)
>  {
>         struct rtw_coex *coex = &rtwdev->coex;
>         struct rtw_coex_stat *coex_stat = &coex->stat;
> -       u8 para[2] = {0};
> +       u8 para[6] = {0};

The fix is correct. However, I don't prefer 0 as initializer.
Please use this style: 

  u8 para[6] = {};