From patchwork Wed Oct 10 18:13:12 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Franky Lin X-Patchwork-Id: 1575171 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 925BADFB34 for ; Wed, 10 Oct 2012 18:13:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932158Ab2JJSN1 (ORCPT ); Wed, 10 Oct 2012 14:13:27 -0400 Received: from mms2.broadcom.com ([216.31.210.18]:3968 "EHLO mms2.broadcom.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756944Ab2JJSNZ (ORCPT ); Wed, 10 Oct 2012 14:13:25 -0400 Received: from [10.9.200.131] by mms2.broadcom.com with ESMTP (Broadcom SMTP Relay (Email Firewall v6.5)); Wed, 10 Oct 2012 11:11:36 -0700 X-Server-Uuid: 4500596E-606A-40F9-852D-14843D8201B2 Received: from mail-irva-13.broadcom.com (10.11.16.103) by IRVEXCHHUB01.corp.ad.broadcom.com (10.9.200.131) with Microsoft SMTP Server id 8.2.247.2; Wed, 10 Oct 2012 11:13:15 -0700 Received: from mail-sj1-12.sj.broadcom.com (mail-sj1-12.sj.broadcom.com [10.17.16.106]) by mail-irva-13.broadcom.com (Postfix) with ESMTP id 2ACF040FE7; Wed, 10 Oct 2012 11:13:15 -0700 (PDT) Received: from lc-sj1-3560.broadcom.com (lc-sj1-3560.sj.broadcom.com [10.17.194.250]) by mail-sj1-12.sj.broadcom.com (Postfix) with ESMTP id E5FA3207D5; Wed, 10 Oct 2012 11:13:13 -0700 (PDT) Received: by lc-sj1-3560.broadcom.com (Postfix, from userid 25250) id B719A158A5BA; Wed, 10 Oct 2012 11:13:12 -0700 (PDT) From: "Franky Lin" To: linville@tuxdriver.com cc: linux-wireless@vger.kernel.org, "Dan Carpenter" Subject: [PATCH 7/7] brcmfmac: fix end of loop check (signedness bug) Date: Wed, 10 Oct 2012 11:13:12 -0700 Message-ID: <1349892792-4792-8-git-send-email-frankyl@broadcom.com> X-Mailer: git-send-email 1.7.6 In-Reply-To: <1349892792-4792-1-git-send-email-frankyl@broadcom.com> References: <1349892792-4792-1-git-send-email-frankyl@broadcom.com> MIME-Version: 1.0 X-WSS-ID: 7C6B65D23OW3861664-01-01 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Dan Carpenter The problem here is that we loop until "remained_buf_len" is less than zero, but since it is unsigned, it never is. "remained_buf_len" has to be large enough to hold the value from "mgmt_ie_buf_len". That variable is type u32, but it only holds small values so I have changed to both variables to int. Also I removed the bogus initialization from "mgmt_ie_buf_len" so that GCC can detect if it is used unitialized. I moved the declaration of "remained_buf_len" closer to where it is used so it's easier to read. Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Hante Meuleman Signed-off-by: Dan Carpenter Signed-off-by: Franky Lin --- .../net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c index 5e51f15..1c83612 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c @@ -3972,7 +3972,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg, u8 *iovar_ie_buf; u8 *curr_ie_buf; u8 *mgmt_ie_buf = NULL; - u32 mgmt_ie_buf_len; + int mgmt_ie_buf_len; u32 *mgmt_ie_len; u32 del_add_ie_buf_len = 0; u32 total_ie_buf_len = 0; @@ -3982,7 +3982,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg, struct parsed_vndr_ie_info *vndrie_info; s32 i; u8 *ptr; - u32 remained_buf_len; + int remained_buf_len; WL_TRACE("bssidx %d, pktflag : 0x%02X\n", bssidx, pktflag); iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);