* [bug report] mt76: mt7615: fix CSA notification for DBDC
@ 2021-04-21 10:20 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-04-21 10:20 UTC (permalink / raw)
To: ryder.lee; +Cc: linux-wireless, linux-mediatek
Hello Ryder Lee,
The patch 402a695b1ae6: "mt76: mt7615: fix CSA notification for DBDC"
from Feb 27, 2021, leads to the following static checker warning:
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c:385 mt7615_mcu_rx_csa_notify()
error: undefined (user controlled) shift '(((1))) << (c->omac_idx)'
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
376 static void
377 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
378 {
379 struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
380 struct mt76_phy *mphy = &dev->mt76.phy;
381 struct mt7615_mcu_csa_notify *c;
382
383 c = (struct mt7615_mcu_csa_notify *)skb->data;
^ ^^^^^^^^^
c is random data from the network
384
385 if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
^^^^^^^^^^^
Any value more than 61 will lead to undefined behavior. (shift wrapping
mostly).
386 mphy = dev->mt76.phy2;
387
388 ieee80211_iterate_active_interfaces_atomic(mphy->hw,
389 IEEE80211_IFACE_ITER_RESUME_ALL,
390 mt7615_mcu_csa_finish, mphy->hw);
391 }
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
* [bug report] mt76: mt7615: fix CSA notification for DBDC
@ 2021-04-21 10:20 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-04-21 10:20 UTC (permalink / raw)
To: ryder.lee; +Cc: linux-wireless, linux-mediatek
Hello Ryder Lee,
The patch 402a695b1ae6: "mt76: mt7615: fix CSA notification for DBDC"
from Feb 27, 2021, leads to the following static checker warning:
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c:385 mt7615_mcu_rx_csa_notify()
error: undefined (user controlled) shift '(((1))) << (c->omac_idx)'
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
376 static void
377 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
378 {
379 struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
380 struct mt76_phy *mphy = &dev->mt76.phy;
381 struct mt7615_mcu_csa_notify *c;
382
383 c = (struct mt7615_mcu_csa_notify *)skb->data;
^ ^^^^^^^^^
c is random data from the network
384
385 if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
^^^^^^^^^^^
Any value more than 61 will lead to undefined behavior. (shift wrapping
mostly).
386 mphy = dev->mt76.phy2;
387
388 ieee80211_iterate_active_interfaces_atomic(mphy->hw,
389 IEEE80211_IFACE_ITER_RESUME_ALL,
390 mt7615_mcu_csa_finish, mphy->hw);
391 }
regards,
dan carpenter
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-04-21 10:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-21 10:20 [bug report] mt76: mt7615: fix CSA notification for DBDC Dan Carpenter
2021-04-21 10:20 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.