* [PATCH 1/2] wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read()
@ 2022-12-07 7:30 Ryder Lee
2022-12-07 7:30 ` [PATCH 2/2] wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read() Ryder Lee
0 siblings, 1 reply; 2+ messages in thread
From: Ryder Lee @ 2022-12-07 7:30 UTC (permalink / raw)
To: Felix Fietkau, linux-wireless
Cc: Lorenzo Bianconi, Shayne Chen, Evelyn Tsai, linux-mediatek, Ryder Lee
In the expression "map[i].qid << 24" starts as u8, but is promoted to
"signed int", then sign-extended to type "unsigned long", which is not
intended. Cast to u32 to avoid the sign extension.
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527813 ("Integer handling issues")
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
index 99b23aef53a5..3d4fbbbcc206 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
@@ -457,7 +457,7 @@ mt7996_hw_queue_read(struct seq_file *s, u32 size,
if (val & BIT(map[i].index))
continue;
- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24);
+ ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24);
mt76_wr(dev, MT_FL_Q0_CTRL, ctrl);
head = mt76_get_field(dev, MT_FL_Q2_CTRL,
--
2.18.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH 2/2] wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read()
2022-12-07 7:30 [PATCH 1/2] wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read() Ryder Lee
@ 2022-12-07 7:30 ` Ryder Lee
0 siblings, 0 replies; 2+ messages in thread
From: Ryder Lee @ 2022-12-07 7:30 UTC (permalink / raw)
To: Felix Fietkau, linux-wireless
Cc: Lorenzo Bianconi, Shayne Chen, Evelyn Tsai, linux-mediatek, Ryder Lee
In the expression "map[i].qid << 24" starts as u8, but is promoted to
"signed int", then sign-extended to type "unsigned long", which is not
intended. Cast to u32 to avoid the sign extension.
Fixes: 776ec4e77aa6 ("mt76: mt7915: rework debugfs queue info")
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
index a7fdcd1f3d98..5a46813a59ea 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
@@ -811,7 +811,7 @@ mt7915_hw_queue_read(struct seq_file *s, u32 size,
if (val & BIT(map[i].index))
continue;
- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24);
+ ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24);
mt76_wr(dev, MT_FL_Q0_CTRL, ctrl);
head = mt76_get_field(dev, MT_FL_Q2_CTRL,
--
2.18.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-12-07 7:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-07 7:30 [PATCH 1/2] wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read() Ryder Lee
2022-12-07 7:30 ` [PATCH 2/2] wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read() Ryder Lee
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.