]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: rtw89: correct base HT rate mask for firmware
authorPing-Ke Shih <pkshih@realtek.com>
Fri, 9 Aug 2024 07:20:10 +0000 (15:20 +0800)
committerPing-Ke Shih <pkshih@realtek.com>
Fri, 16 Aug 2024 11:27:26 +0000 (19:27 +0800)
commit45742881f9eee2a4daeb6008e648a460dd3742cd
treecb291750cd40258e18edaa6c0dc85433ca20d2fc
parent56310ddb50b190b3390fdc974aec455d0a516bd2
wifi: rtw89: correct base HT rate mask for firmware

Coverity reported that u8 rx_mask << 24 will become signed 32 bits, which
casting to unsigned 64 bits will do sign extension. For example,
putting 0x80000000 (signed 32 bits) to a u64 variable will become
0xFFFFFFFF_80000000.

The real case we meet is:
  rx_mask[0...3] = ff ff 00 00
  ra_mask = 0xffffffff_ff0ff000

After this fix:
  rx_mask[0...3] = ff ff 00 00
  ra_mask = 0x00000000_ff0ff000

Fortunately driver does bitwise-AND with incorrect ra_mask and supported
rates (1ss and 2ss rate only) afterward, so the final rate mask of
original code is still correct.

Addresses-Coverity-ID: 1504762 ("Unintended sign extension")

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20240809072012.84152-5-pkshih@realtek.com
drivers/net/wireless/realtek/rtw89/phy.c