| Message ID | 20241009004300.8144-2-pkshih@realtek.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Ping-Ke Shih |
| Headers | show |
| Series | wifi: rtw89: correct improper data types found by Coverity | expand |
Ping-Ke Shih <pkshih@realtek.com> wrote: > The type of tsf arithmetic is > u64 += u16 * int; > > When (u16 * int) is larger than 0x7FFFFFFF, the value casting to u64 with > sign-extension will become all 1 in upper 32 bits part. > > To meet the case, u16 value should be larger than 20491 > (0x7FFFFFFF / 104800). Fortunately the meaning of 20491 is delay time of > WoWLAN net detection in unit of second, so 20491 seconds (5.7 hours) > might not a real case we can meet. > > Addresses-Coverity-ID: 1620910 ("Unintended sign extension") > > Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> 6 patch(es) applied to rtw-next branch of rtw.git, thanks. 5af57c4f9937 wifi: rtw89: wow: cast nd_config->delay to u64 in tsf arithmetic 778e2478d195 wifi: rtw89: pci: use 'int' as return type of error code in poll_{tx,rx}dma_ch_idle() 66595e319886 wifi: rtw89: 8851b: use 'int' as return type of error code pwr_{on,off}_func() 50e9febff35f wifi: rtw89: 8852b: use 'int' as return type of error code pwr_{on,off}_func() c72c54fd96d0 wifi: rtw89: 8852bt: use 'int' as return type of error code pwr_{on,off}_func() 74432751ff63 wifi: rtw89: 8852c: use 'int' as return type of error code pwr_{on,off}_func() --- https://github.com/pkshih/rtw.git
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 752a3c2536d4..252812781514 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -4963,7 +4963,7 @@ int rtw89_fw_h2c_scan_offload_ax(struct rtw89_dev *rtwdev, scan_mode = RTW89_SCAN_IMMEDIATE; } else { scan_mode = RTW89_SCAN_DELAY; - tsf += option->delay * RTW89_SCAN_DELAY_TSF_UNIT; + tsf += (u64)option->delay * RTW89_SCAN_DELAY_TSF_UNIT; } }
The type of tsf arithmetic is u64 += u16 * int; When (u16 * int) is larger than 0x7FFFFFFF, the value casting to u64 with sign-extension will become all 1 in upper 32 bits part. To meet the case, u16 value should be larger than 20491 (0x7FFFFFFF / 104800). Fortunately the meaning of 20491 is delay time of WoWLAN net detection in unit of second, so 20491 seconds (5.7 hours) might not a real case we can meet. Addresses-Coverity-ID: 1620910 ("Unintended sign extension") Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> --- drivers/net/wireless/realtek/rtw89/fw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)