The rtw_pci_init_rx_ring function is only ever called with a fixed constant or RTK_MAX_RX_DESC_NUM for the "len" argument. Since this constant is defined as 512, the "if (len > TRX_BD_IDX_MASK)" check can never happen (TRX_BD_IDX_MASK is defined as GENMASK(11, 0) or in other words as 4095). So, remove this check. Signed-off-by: Len Baker <len.baker@xxxxxxx> --- Changelog v1 -> v2 - Remove the macro ARRAY_SIZE from the for loop (Pkshih, Brian Norris). - Add a new check for the len variable (Pkshih, Brian Norris). Changelog v2 -> v3 - Change the subject of the patch. - Remove the "if" check statement (Greg KH) - Remove the "Fixes" tag, "Addresses-Coverity-ID" tag and Cc to stable. The previous versions can be found at: v1 https://lore.kernel.org/lkml/20210711141634.6133-1-len.baker@xxxxxxx/ v2 https://lore.kernel.org/lkml/20210716155311.5570-1-len.baker@xxxxxxx/ drivers/net/wireless/realtek/rtw88/pci.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c index e7d17ab8f113..f17e7146f20f 100644 --- a/drivers/net/wireless/realtek/rtw88/pci.c +++ b/drivers/net/wireless/realtek/rtw88/pci.c @@ -268,11 +268,6 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev, int i, allocated; int ret = 0; - if (len > TRX_BD_IDX_MASK) { - rtw_err(rtwdev, "len %d exceeds maximum RX entries\n", len); - return -EINVAL; - } - head = dma_alloc_coherent(&pdev->dev, ring_sz, &dma, GFP_KERNEL); if (!head) { rtw_err(rtwdev, "failed to allocate rx ring\n"); -- 2.25.1
