net: wireless: rockchip_wlan: realtek wifi: avoid illegal argument when called by ioctl SIOCDEVPRIVATE

Weiguo Hu · rkhuangtao · commit a4bdf4341a4b · 2020-11-12T11:07:57.000+08:00
Illegal argument will cause following kernel panic.

Call trace:
  PHY_SetRFReg_8723B
  rtw_hal_write_rfreg
  rtw_wx_write_rf
  _rtw_ioctl_wext_private
  rtw_ioctl
  dev_ifsioc
  dev_ioctl

References: CNVD-C-2020-259508
Signed-off-by: Weiguo Hu &lt;hwg@rock-chips.com&gt;
Change-Id: Ia493d8276c1dd414c184a9b3eddb5d252bd85b98
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/hal/rtl8188e/rtl8188e_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/hal/rtl8188e/rtl8188e_phycfg.c
@@ -704,6 +704,9 @@ PHY_SetRFReg8188E(
 	u32		Original_Value, BitShift;
 	/* _irqL	irqL; */
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/hal/rtl8188f/rtl8188f_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/hal/rtl8188f/rtl8188f_phycfg.c
@@ -433,6 +433,9 @@ PHY_SetRFReg_8188F(
 {
 	u32		Original_Value, BitShift;
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/hal/rtl8188e/rtl8188e_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/hal/rtl8188e/rtl8188e_phycfg.c
@@ -718,6 +718,9 @@ PHY_SetRFReg8188E(
 	u32		Original_Value, BitShift;
 	//_irqL	irqL;
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189fs/hal/rtl8188f/rtl8188f_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8189fs/hal/rtl8188f/rtl8188f_phycfg.c
@@ -371,6 +371,9 @@ PHY_SetRFReg_8188F(
 {
 	u32		Original_Value, BitShift;
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/hal/rtl8723b/rtl8723b_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8723bs/hal/rtl8723b/rtl8723b_phycfg.c
@@ -427,6 +427,9 @@ PHY_SetRFReg_8723B(
 {
 	u32		Original_Value, BitShift;
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/hal/rtl8723b/rtl8723b_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/hal/rtl8723b/rtl8723b_phycfg.c
@@ -439,6 +439,9 @@ PHY_SetRFReg_8723B(
 {
 	u32		Original_Value, BitShift;
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/hal/rtl8703b/rtl8703b_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/hal/rtl8703b/rtl8703b_phycfg.c
@@ -432,6 +432,9 @@ PHY_SetRFReg_8703B(
 {
 	u32		Original_Value, BitShift;
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723ds/hal/rtl8723d/rtl8723d_phycfg.c b/drivers/net/wireless/rockchip_wlan/rtl8723ds/hal/rtl8723d/rtl8723d_phycfg.c
@@ -372,6 +372,9 @@ PHY_SetRFReg_8723D(
 {
 	u32		Original_Value, BitShift;
 
+	if (eRFPath >= MAX_RF_PATH)
+		return;
+
 #if (DISABLE_BB_RF == 1)
 	return;
 #endif
@@ -1191,4 +1194,4 @@ PHY_SetSwChnlBWMode8723D(
 
 	/* RTW_INFO("<==%s()\n",__FUNCTION__); */
 }
- 
+ 

Original file line number	Diff line number	Diff line change
`@@ -433,6 +433,9 @@ PHY_SetRFReg_8188F(`
`433`	`433`	`{`
`434`	`434`	`u32 Original_Value, BitShift;`
`435`	`435`
	`436`	`+ if (eRFPath >= MAX_RF_PATH)`
	`437`	`+ return;`
	`438`	`+`
`436`	`439`	`#if (DISABLE_BB_RF == 1)`
`437`	`440`	`return;`
`438`	`441`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -371,6 +371,9 @@ PHY_SetRFReg_8188F(`
`371`	`371`	`{`
`372`	`372`	`u32 Original_Value, BitShift;`
`373`	`373`
	`374`	`+ if (eRFPath >= MAX_RF_PATH)`
	`375`	`+ return;`
	`376`	`+`
`374`	`377`	`#if (DISABLE_BB_RF == 1)`
`375`	`378`	`return;`
`376`	`379`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -427,6 +427,9 @@ PHY_SetRFReg_8723B(`
`427`	`427`	`{`
`428`	`428`	`u32 Original_Value, BitShift;`
`429`	`429`
	`430`	`+ if (eRFPath >= MAX_RF_PATH)`
	`431`	`+ return;`
	`432`	`+`
`430`	`433`	`#if (DISABLE_BB_RF == 1)`
`431`	`434`	`return;`
`432`	`435`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -439,6 +439,9 @@ PHY_SetRFReg_8723B(`
`439`	`439`	`{`
`440`	`440`	`u32 Original_Value, BitShift;`
`441`	`441`
	`442`	`+ if (eRFPath >= MAX_RF_PATH)`
	`443`	`+ return;`
	`444`	`+`
`442`	`445`	`#if (DISABLE_BB_RF == 1)`
`443`	`446`	`return;`
`444`	`447`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -432,6 +432,9 @@ PHY_SetRFReg_8703B(`
`432`	`432`	`{`
`433`	`433`	`u32 Original_Value, BitShift;`
`434`	`434`
	`435`	`+ if (eRFPath >= MAX_RF_PATH)`
	`436`	`+ return;`
	`437`	`+`
`435`	`438`	`#if (DISABLE_BB_RF == 1)`
`436`	`439`	`return;`
`437`	`440`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -372,6 +372,9 @@ PHY_SetRFReg_8723D(`
`372`	`372`	`{`
`373`	`373`	`u32 Original_Value, BitShift;`
`374`	`374`
	`375`	`+ if (eRFPath >= MAX_RF_PATH)`
	`376`	`+ return;`
	`377`	`+`
`375`	`378`	`#if (DISABLE_BB_RF == 1)`
`376`	`379`	`return;`
`377`	`380`	`#endif`
`@@ -1191,4 +1194,4 @@ PHY_SetSwChnlBWMode8723D(`
`1191`	`1194`
`1192`	`1195`	`/* RTW_INFO("<==%s()\n",__FUNCTION__); */`
`1193`	`1196`	`}`
`1194`		`-`
	`1197`	`+`