* [PATCH] wifi: cisco: do not assign -1 to unsigned char
@ 2022-10-24 16:28 Jason A. Donenfeld
2022-10-25 10:11 ` David Laight
2022-11-01 9:15 ` wifi: airo: " Kalle Valo
0 siblings, 2 replies; 4+ messages in thread
From: Jason A. Donenfeld @ 2022-10-24 16:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Jason A. Donenfeld, Kalle Valo, linux-wireless
With char becoming unsigned by default, and with `char` alone being
ambiguous and based on architecture, we get a warning when assigning the
unchecked output of hex_to_bin() to that unsigned char. Mark `key` as a
`u8`, which matches the struct's type, and then check each call to
hex_to_bin() before casting.
Cc: Kalle Valo <kvalo@kernel.org>
Cc: linux-wireless@vger.kernel.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
drivers/net/wireless/cisco/airo.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
index 10daef81c355..fb2c35bd73bb 100644
--- a/drivers/net/wireless/cisco/airo.c
+++ b/drivers/net/wireless/cisco/airo.c
@@ -5232,7 +5232,7 @@ static int get_wep_tx_idx(struct airo_info *ai)
return -1;
}
-static int set_wep_key(struct airo_info *ai, u16 index, const char *key,
+static int set_wep_key(struct airo_info *ai, u16 index, const u8 *key,
u16 keylen, int perm, int lock)
{
static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 };
@@ -5283,7 +5283,7 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file)
struct net_device *dev = pde_data(inode);
struct airo_info *ai = dev->ml_priv;
int i, rc;
- char key[16];
+ u8 key[16];
u16 index = 0;
int j = 0;
@@ -5311,12 +5311,22 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file)
}
for (i = 0; i < 16*3 && data->wbuffer[i+j]; i++) {
+ int val;
+
+ if (i % 3 == 2)
+ continue;
+
+ val = hex_to_bin(data->wbuffer[i+j]);
+ if (val < 0) {
+ airo_print_err(ai->dev->name, "WebKey passed invalid key hex");
+ return;
+ }
switch(i%3) {
case 0:
- key[i/3] = hex_to_bin(data->wbuffer[i+j])<<4;
+ key[i/3] = (u8)val << 4;
break;
case 1:
- key[i/3] |= hex_to_bin(data->wbuffer[i+j]);
+ key[i/3] |= (u8)val;
break;
}
}
--
2.38.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH] wifi: cisco: do not assign -1 to unsigned char
2022-10-24 16:28 [PATCH] wifi: cisco: do not assign -1 to unsigned char Jason A. Donenfeld
@ 2022-10-25 10:11 ` David Laight
2022-10-25 12:12 ` Jason A. Donenfeld
2022-11-01 9:15 ` wifi: airo: " Kalle Valo
1 sibling, 1 reply; 4+ messages in thread
From: David Laight @ 2022-10-25 10:11 UTC (permalink / raw)
To: 'Jason A. Donenfeld', linux-kernel; +Cc: Kalle Valo, linux-wireless
From: Jason A. Donenfeld
> Sent: 24 October 2022 17:29
>
> With char becoming unsigned by default, and with `char` alone being
> ambiguous and based on architecture, we get a warning when assigning the
> unchecked output of hex_to_bin() to that unsigned char. Mark `key` as a
> `u8`, which matches the struct's type, and then check each call to
> hex_to_bin() before casting.
>
> Cc: Kalle Valo <kvalo@kernel.org>
> Cc: linux-wireless@vger.kernel.org
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> ---
> drivers/net/wireless/cisco/airo.c | 18 ++++++++++++++----
> 1 file changed, 14 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
> index 10daef81c355..fb2c35bd73bb 100644
> --- a/drivers/net/wireless/cisco/airo.c
> +++ b/drivers/net/wireless/cisco/airo.c
> @@ -5232,7 +5232,7 @@ static int get_wep_tx_idx(struct airo_info *ai)
> return -1;
> }
>
> -static int set_wep_key(struct airo_info *ai, u16 index, const char *key,
> +static int set_wep_key(struct airo_info *ai, u16 index, const u8 *key,
> u16 keylen, int perm, int lock)
> {
> static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 };
> @@ -5283,7 +5283,7 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file)
> struct net_device *dev = pde_data(inode);
> struct airo_info *ai = dev->ml_priv;
> int i, rc;
> - char key[16];
> + u8 key[16];
> u16 index = 0;
> int j = 0;
>
> @@ -5311,12 +5311,22 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file)
> }
>
> for (i = 0; i < 16*3 && data->wbuffer[i+j]; i++) {
> + int val;
> +
> + if (i % 3 == 2)
> + continue;
> +
> + val = hex_to_bin(data->wbuffer[i+j]);
> + if (val < 0) {
> + airo_print_err(ai->dev->name, "WebKey passed invalid key hex");
> + return;
> + }
> switch(i%3) {
> case 0:
> - key[i/3] = hex_to_bin(data->wbuffer[i+j])<<4;
> + key[i/3] = (u8)val << 4;
> break;
> case 1:
> - key[i/3] |= hex_to_bin(data->wbuffer[i+j]);
> + key[i/3] |= (u8)val;
> break;
> }
> }
That is about the crappiest loop I've seen.
I was just going to point out that the (u8) casts aren't needed.
Something like:
for (i = 0, buf = data->wbuffer + j; i < 16; i++, buf += 3) {
int val;
if (!buf[0] || !buf[1])
break;
val = hex_to_bin(buf[0]) | hex_to_bin(buf[1]) << 8;
if (val < 0) {
airo_print_err(ai->dev->name, "WebKey passed invalid key hex");
return;
}
key[i] = val;
if (!buf[2])
break;
}
Although there should be a check for buf[2] being valid.
Any I worry about exactly what happens if there aren't 16 full bytes.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] wifi: cisco: do not assign -1 to unsigned char
2022-10-25 10:11 ` David Laight
@ 2022-10-25 12:12 ` Jason A. Donenfeld
0 siblings, 0 replies; 4+ messages in thread
From: Jason A. Donenfeld @ 2022-10-25 12:12 UTC (permalink / raw)
To: David Laight; +Cc: linux-kernel, Kalle Valo, linux-wireless
On Tue, Oct 25, 2022 at 10:11:44AM +0000, David Laight wrote:
> From: Jason A. Donenfeld
> > Sent: 24 October 2022 17:29
> >
> > With char becoming unsigned by default, and with `char` alone being
> > ambiguous and based on architecture, we get a warning when assigning the
> > unchecked output of hex_to_bin() to that unsigned char. Mark `key` as a
> > `u8`, which matches the struct's type, and then check each call to
> > hex_to_bin() before casting.
> >
> > Cc: Kalle Valo <kvalo@kernel.org>
> > Cc: linux-wireless@vger.kernel.org
> > Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> > ---
> > drivers/net/wireless/cisco/airo.c | 18 ++++++++++++++----
> > 1 file changed, 14 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
> > index 10daef81c355..fb2c35bd73bb 100644
> > --- a/drivers/net/wireless/cisco/airo.c
> > +++ b/drivers/net/wireless/cisco/airo.c
> > @@ -5232,7 +5232,7 @@ static int get_wep_tx_idx(struct airo_info *ai)
> > return -1;
> > }
> >
> > -static int set_wep_key(struct airo_info *ai, u16 index, const char *key,
> > +static int set_wep_key(struct airo_info *ai, u16 index, const u8 *key,
> > u16 keylen, int perm, int lock)
> > {
> > static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 };
> > @@ -5283,7 +5283,7 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file)
> > struct net_device *dev = pde_data(inode);
> > struct airo_info *ai = dev->ml_priv;
> > int i, rc;
> > - char key[16];
> > + u8 key[16];
> > u16 index = 0;
> > int j = 0;
> >
> > @@ -5311,12 +5311,22 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file)
> > }
> >
> > for (i = 0; i < 16*3 && data->wbuffer[i+j]; i++) {
> > + int val;
> > +
> > + if (i % 3 == 2)
> > + continue;
> > +
> > + val = hex_to_bin(data->wbuffer[i+j]);
> > + if (val < 0) {
> > + airo_print_err(ai->dev->name, "WebKey passed invalid key hex");
> > + return;
> > + }
> > switch(i%3) {
> > case 0:
> > - key[i/3] = hex_to_bin(data->wbuffer[i+j])<<4;
> > + key[i/3] = (u8)val << 4;
> > break;
> > case 1:
> > - key[i/3] |= hex_to_bin(data->wbuffer[i+j]);
> > + key[i/3] |= (u8)val;
> > break;
> > }
> > }
>
> That is about the crappiest loop I've seen.
> I was just going to point out that the (u8) casts aren't needed.
> Something like:
> for (i = 0, buf = data->wbuffer + j; i < 16; i++, buf += 3) {
> int val;
> if (!buf[0] || !buf[1])
> break;
> val = hex_to_bin(buf[0]) | hex_to_bin(buf[1]) << 8;
> if (val < 0) {
> airo_print_err(ai->dev->name, "WebKey passed invalid key hex");
> return;
> }
> key[i] = val;
> if (!buf[2])
> break;
> }
>
> Although there should be a check for buf[2] being valid.
> Any I worry about exactly what happens if there aren't 16 full bytes.
buf[2] isn't checked. Presumably it's a space or something. Your <<8
also isn't right; this is a hex char. Anyway, I think I'd rather
minimize this delta and leave this patch as-is.
Jason
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: wifi: airo: do not assign -1 to unsigned char
2022-10-24 16:28 [PATCH] wifi: cisco: do not assign -1 to unsigned char Jason A. Donenfeld
2022-10-25 10:11 ` David Laight
@ 2022-11-01 9:15 ` Kalle Valo
1 sibling, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2022-11-01 9:15 UTC (permalink / raw)
To: Jason A. Donenfeld; +Cc: linux-kernel, Jason A. Donenfeld, linux-wireless
"Jason A. Donenfeld" <Jason@zx2c4.com> wrote:
> With char becoming unsigned by default, and with `char` alone being
> ambiguous and based on architecture, we get a warning when assigning the
> unchecked output of hex_to_bin() to that unsigned char. Mark `key` as a
> `u8`, which matches the struct's type, and then check each call to
> hex_to_bin() before casting.
>
> Cc: Kalle Valo <kvalo@kernel.org>
> Cc: linux-wireless@vger.kernel.org
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Patch applied to wireless.git, thanks.
e6cb8769452e wifi: airo: do not assign -1 to unsigned char
--
https://patchwork.kernel.org/project/linux-wireless/patch/20221024162843.535921-1-Jason@zx2c4.com/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-11-01 9:15 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-24 16:28 [PATCH] wifi: cisco: do not assign -1 to unsigned char Jason A. Donenfeld
2022-10-25 10:11 ` David Laight
2022-10-25 12:12 ` Jason A. Donenfeld
2022-11-01 9:15 ` wifi: airo: " Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).