Merge: CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7122

JIRA: https://issues.redhat.com/browse/RHEL-103158
CVE: CVE-2025-38159

```
commit 4c2c372
Author: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Date:   Tue May 13 12:13:04 2025 +0000

    wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

    Set the size to 6 instead of 2, since 'para' array is passed to
    'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads
    5 bytes:

    void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
    {
        ...
        SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
        SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
        ...
        SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));

    Detected using the static analysis tool - Svace.
    Fixes: 4136214 ("rtw88: add BT co-existence support")
    Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
    Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
    Link: https://patch.msgid.link/20250513121304.124141-1-aleksei.kodanev@bell-sw.com
```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-07-12 14:52 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: Michal Schmidt <mschmidt@redhat.com>
Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Augusto Caringi <acaringi@redhat.com>

Author: caringi

drivers/net/wireless/realtek/rtw88/coex.c

@@ -309,7 +309,7 @@ static void rtw_coex_tdma_timer_base(struct rtw_dev *rtwdev, u8 type)
 {
 	struct rtw_coex *coex = &rtwdev->coex;
 	struct rtw_coex_stat *coex_stat = &coex->stat;
-	u8 para[2] = {0};
+	u8 para[6] = {};
 	u8 times;
 	u16 tbtt_interval = coex_stat->wl_beacon_interval;