[PATCH rtw-next 07/15] wifi: rtw89: fw: cmd_ofld_flush always reset counter

[Ping-Ke Shih <pkshih@realtek.com>]

From: Zong-Zhe Yang <kevin_yang@realtek.com>

Callers expect cmd offload counter is reset after flushing, and then
use counter++ with array index. Previously, it might cause OOB since
cmd_ofld_flush gets an error, e.g out of memory, and does not reset
the cmd offload counter. Fix cmd_ofld_flush to always reset it.

Resolve OVERRUN (Out-of-bounds write) reported by Coverity.
Pass info to cmd_ofld_flush to make Coverity aware the changes on
cmd offload counter.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/fw.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index a16127b2c317..dcbdf4b5e4b2 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -12643,9 +12643,9 @@ static int rtw89_fw_cmd_ofld_pack(struct rtw89_dev *rtwdev)
 	return 0;
 }
 
-static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev)
+static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev,
+				    struct rtw89_fw_cmd_ofld_info *info)
 {
-	struct rtw89_fw_cmd_ofld_info *info = rtwdev->fw_cmd_ofld_info;
 	struct sk_buff *skb;
 	int ret;
 	u32 len;
@@ -12654,7 +12654,7 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev)
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "alloc skb fail\n");
-		return;
+		goto out;
 	}
 
 	skb_put_data(skb, info->cmds, len);
@@ -12669,12 +12669,13 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev)
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send cmd ofld\n");
 		dev_kfree_skb_any(skb);
-		return;
+		goto out;
 	}
 
 	if (info->accu_delay)
 		fsleep(info->accu_delay);
 
+out:
 	info->cnt = 0;
 	info->accu_delay = 0;
 }
@@ -12694,7 +12695,7 @@ static int rtw89_fw_cmd_ofld_unpack(struct rtw89_dev *rtwdev)
 	if (info->cnt == 0)
 		return 0;
 
-	rtw89_fw_cmd_ofld_flush(rtwdev);
+	rtw89_fw_cmd_ofld_flush(rtwdev, info);
 
 	return 0;
 }
@@ -12721,7 +12722,7 @@ static int rtw89_fw_cmd_ofld_enqueue(struct rtw89_dev *rtwdev,
 		return -EFAULT;
 
 	if (info->cnt >= ARRAY_SIZE(info->cmds))
-		rtw89_fw_cmd_ofld_flush(rtwdev);
+		rtw89_fw_cmd_ofld_flush(rtwdev, info);
 
 	h2c = &info->cmds[info->cnt++];
 
-- 
2.25.1