]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
wifi: rtw89: wow: cast nd_config->delay to u64 in tsf arithmetic
authorPing-Ke Shih <pkshih@realtek.com>
Wed, 9 Oct 2024 00:42:55 +0000 (08:42 +0800)
committerPing-Ke Shih <pkshih@realtek.com>
Sun, 20 Oct 2024 02:29:55 +0000 (10:29 +0800)
The type of tsf arithmetic is
   u64 += u16 * int;

When (u16 * int) is larger than 0x7FFFFFFF, the value casting to u64 with
sign-extension will become all 1 in upper 32 bits part.

To meet the case, u16 value should be larger than 20491
(0x7FFFFFFF / 104800). Fortunately the meaning of 20491 is delay time of
WoWLAN net detection in unit of second, so 20491 seconds (5.7 hours)
might not a real case we can meet.

Addresses-Coverity-ID: 1620910 ("Unintended sign extension")

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241009004300.8144-2-pkshih@realtek.com
drivers/net/wireless/realtek/rtw89/fw.c

index 2c2fdf21f06587a3e3a26364a5dff146a5f5c008..744a8d277cfc026b1bb9113cefb6af2d316ee00f 100644 (file)
@@ -4965,7 +4965,7 @@ int rtw89_fw_h2c_scan_offload_ax(struct rtw89_dev *rtwdev,
                        scan_mode = RTW89_SCAN_IMMEDIATE;
                } else {
                        scan_mode = RTW89_SCAN_DELAY;
-                       tsf += option->delay * RTW89_SCAN_DELAY_TSF_UNIT;
+                       tsf += (u64)option->delay * RTW89_SCAN_DELAY_TSF_UNIT;
                }
        }