[PATCH rtw-next 06/15] wifi: rtw89: 8852a: prevent potential OOB in ctrl_sco_cck

[Ping-Ke Shih <pkshih@realtek.com>]

From: Zong-Zhe Yang <kevin_yang@realtek.com>

The array size is 14. Add a check to avoid out-of-bound access.
Although it doesn't seem to happen if everything follows spec.,
it might have potential problem in pure logic.

Resolve OVERRUN (Out-of-bounds access) reported by Coverity.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/rtw8852a.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
index 5d7b5d1a24b1..4b364f039464 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
@@ -945,6 +945,14 @@ static int rtw8852a_ctrl_sco_cck(struct rtw89_dev *rtwdev, u8 central_ch,
 		rtw89_warn(rtwdev, "Invalid BW:%d for CCK\n", bw);
 		return -EINVAL;
 	}
+
+	if (unlikely(ch_element >= 14)) {
+		rtw89_warn(rtwdev,
+			   "Invalid ch_element:%u where central_ch %u primary_ch %u\n",
+			   ch_element, central_ch, primary_ch);
+		return -EINVAL;
+	}
+
 	rtw89_phy_write32_mask(rtwdev, R_RXSCOBC, B_RXSCOBC_TH,
 			       rtw8852a_sco_barker_threshold[ch_element]);
 	rtw89_phy_write32_mask(rtwdev, R_RXSCOCCK, B_RXSCOCCK_TH,
-- 
2.25.1