Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43d59a4c authored by Emmanuel Grumbach's avatar Emmanuel Grumbach Committed by Luca Coelho
Browse files

iwlwifi: mvm: don't call << operator with a negative value 

In https://bugzilla.kernel.org/show_bug.cgi?id=177341 Bob
reported a UBSAN WARNING on rs.c in iwldvm.
Fix the same bug in iwlmvm.

This because
	i = index - 1;
	for (mask = (1 << i); i >= 0; i--, mask >>= 1)

is unsafe: i could be negative and hence we can call <<
on a negative value.
This bug doesn't have any real impact since the condition
of the for loop will prevent any usage of mask.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=177341


Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 1aa0ec5c

drivers/net/wireless/intel/iwlwifi/mvm/rs.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -972,7 +972,9 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask, 




		/* Find the previous rate that is in the rate mask */

		/* Find the previous rate that is in the rate mask */

		i = index - 1;

		i = index - 1;

		for (mask = (1 << i); i >= 0; i--, mask >>= 1) {

		if (i >= 0)

			mask = BIT(i);

		for (; i >= 0; i--, mask >>= 1) {

			if (rate_mask & mask) {

			if (rate_mask & mask) {

				low = i;

				low = i;

				break;

				break;