diff options
| author | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2017-01-07 19:57:46 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2017-02-08 17:54:21 +0200 |
| commit | 43d59a4ce78b6460b32076ec7ac821fd8678cdc2 (patch) | |
| tree | 6061d611ccaef768e4ed25b0e12f7792775858c1 /drivers/net/wireless/intel/iwlwifi/mvm/rs.c | |
| parent | 1aa0ec5cdf60b23dfc152f0e9e205f58b0a546b2 (diff) | |
iwlwifi: mvm: don't call << operator with a negative value
In https://bugzilla.kernel.org/show_bug.cgi?id=177341 Bob
reported a UBSAN WARNING on rs.c in iwldvm.
Fix the same bug in iwlmvm.
This because
i = index - 1;
for (mask = (1 << i); i >= 0; i--, mask >>= 1)
is unsafe: i could be negative and hence we can call <<
on a negative value.
This bug doesn't have any real impact since the condition
of the for loop will prevent any usage of mask.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=177341
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/rs.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c index 13be9a5b83ee..ce907c58ebf6 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c @@ -972,7 +972,9 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask, /* Find the previous rate that is in the rate mask */ i = index - 1; - for (mask = (1 << i); i >= 0; i--, mask >>= 1) { + if (i >= 0) + mask = BIT(i); + for (; i >= 0; i--, mask >>= 1) { if (rate_mask & mask) { low = i; break; |