On 2020-06-03 17:38:02 [+0800], yhchuang@xxxxxxxxxxx wrote:
> diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821c.c b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
> --- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
> +++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
…
> +static void rtw8821c_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc,
> + struct rtw_rx_pkt_stat *pkt_stat,
> + struct ieee80211_rx_status *rx_status)
> +{
…
> +
> + hdr = (struct ieee80211_hdr *)(rx_desc + desc_sz + pkt_stat->shift +
> + pkt_stat->drv_info_sz);
I did some counting and hdr can be max. rx_desc+147 so it is fine in
terms of a bounds check.
In ff2f20f60cb84d1684379eb5be4c2285@xxxxxxxxxxx you suggested to merge
the function with 8821C/8822B/8822C. Did you change your mind or will
this happen later?
> + if (pkt_stat->phy_status) {
> + phy_status = rx_desc + desc_sz + pkt_stat->shift;
> + query_phy_status(rtwdev, phy_status, pkt_stat);
> + }
> +
> + rtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status, phy_status);
> +}
> +
Sebastian
