diff mbox series

ath11k: fix overflow in tx stats calculation

Message ID 20250303080819.48872-1-a.vatoropin@crpt.ru (mailing list archive)
State New
Delegated to: Jeff Johnson
Headers show
Series ath11k: fix overflow in tx stats calculation | expand

Checks

Context Check Description
jmberg/fixes_present success Fixes tag not required for -next series
jmberg/series_format warning Single patches do not need cover letters; Target tree name not specified in the subject
jmberg/tree_selection success Guessed tree name to be wireless-next
jmberg/ynl success Generated files up to date; no warnings/errors; no diff in generated;
jmberg/build_32bit success Errors and warnings before: 0 this patch: 0
jmberg/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
jmberg/build_clang success Errors and warnings before: 0 this patch: 0
jmberg/build_clang_rust success No Rust files in patch. Skipping build
jmberg/build_tools success No tools touched, skip
jmberg/check_selftest success No net selftest shell script
jmberg/checkpatch success total: 0 errors, 0 warnings, 0 checks, 32 lines checked
jmberg/deprecated_api success None detected
jmberg/header_inline success No static functions without inline keyword in header files
jmberg/kdoc success Errors and warnings before: 0 this patch: 0
jmberg/source_inline success Was 0 now: 0
jmberg/verify_fixes success Fixes tag looks correct
jmberg/verify_signedoff success Signed-off-by tag matches author and committer

Commit Message

Ваторопин Андрей March 3, 2025, 8:08 a.m. UTC 
From: Andrey Vatoropin <a.vatoropin@crpt.ru>

Size of variable peer_stats->succ_bytes equals four bytes.
Size of variable peer_stats->retry_bytes equals four bytes.

The expression peer_stats->succ_bytes+peer_stats->retry_bytes is currently
being evaluated using 32-bit arithmetic. So during the addition an
overflow may occur.

Since a value of type 'u64' is used to store the eventual he, it is
necessary to perform the 64-bit arithmetic to avoid overflow during the
multiplication.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
       
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
---
 drivers/net/wireless/ath/ath11k/debugfs_sta.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
diff mbox series

Patch

diff --git a/drivers/net/wireless/ath/ath11k/debugfs_sta.c b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
index f56a24b6c8da..982a7add6ea6 100644
--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
@@ -69,26 +69,26 @@  void ath11k_debugfs_sta_add_tx_stats(struct ath11k_sta *arsta,
 
 		if (txrate->flags & RATE_INFO_FLAGS_HE_MCS) {
 			STATS_OP_FMT(AMPDU).he[0][mcs] +=
-			peer_stats->succ_bytes + peer_stats->retry_bytes;
+			peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
 			STATS_OP_FMT(AMPDU).he[1][mcs] +=
 			peer_stats->succ_pkts + peer_stats->retry_pkts;
 		} else if (txrate->flags & RATE_INFO_FLAGS_MCS) {
 			STATS_OP_FMT(AMPDU).ht[0][mcs] +=
-			peer_stats->succ_bytes + peer_stats->retry_bytes;
+			peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
 			STATS_OP_FMT(AMPDU).ht[1][mcs] +=
 			peer_stats->succ_pkts + peer_stats->retry_pkts;
 		} else {
 			STATS_OP_FMT(AMPDU).vht[0][mcs] +=
-			peer_stats->succ_bytes + peer_stats->retry_bytes;
+			peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
 			STATS_OP_FMT(AMPDU).vht[1][mcs] +=
 			peer_stats->succ_pkts + peer_stats->retry_pkts;
 		}
 		STATS_OP_FMT(AMPDU).bw[0][bw] +=
-			peer_stats->succ_bytes + peer_stats->retry_bytes;
+			peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
 		STATS_OP_FMT(AMPDU).nss[0][nss] +=
-			peer_stats->succ_bytes + peer_stats->retry_bytes;
+			peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
 		STATS_OP_FMT(AMPDU).gi[0][gi] +=
-			peer_stats->succ_bytes + peer_stats->retry_bytes;
+			peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
 		STATS_OP_FMT(AMPDU).bw[1][bw] +=
 			peer_stats->succ_pkts + peer_stats->retry_pkts;
 		STATS_OP_FMT(AMPDU).nss[1][nss] +=