mac80211: incorrect shift direction

PATCH In review Harvey Harrison 3 participants 4 messages Apr 27, 2008 mac80211

lore

Share & tools

lore

Harvey Harrison

author

2008-04-27 10:48 UTC #0 lore raw

PATCH 1/1 mac80211: incorrect shift direction

Looks like 5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the shifts wrong.

Noticed by sparse:
net/mac80211/tkip.c:234:25: warning: right shift by bigger than source value net/mac80211/tkip.c:235:25: warning: right shift by bigger than source value net/mac80211/tkip.c:236:25: warning: right shift by bigger than source value

Signed-off-by Harvey Harrison <[email protected]>

---
 net/mac80211/tkip.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

net/mac80211/tkip.c +2 -4

index dddbfd6..09093da 100644
@@ -230,10 +230,8 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 
 	iv16 = data[hdr_len] << 8;
 	iv16 += data[hdr_len + 2];
-	iv32 = data[hdr_len + 4] +
-		(data[hdr_len + 5] >> 8) +
-		(data[hdr_len + 6] >> 16) +
-		(data[hdr_len + 7] >> 24);
+	iv32 = data[hdr_len + 4] | (data[hdr_len + 5] << 8) |
+	       (data[hdr_len + 6] << 16) | (data[hdr_len + 7] << 24);
 
 #ifdef CONFIG_TKIP_DEBUG
 	printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",

Signature · 1 line

1.5.5.1.270.g89765

Johannes Berg

maintainer

2008-04-27 11:24 UTC #1 lore raw

Quoted 2 lines · Harvey Harrison

Looks like 5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the shifts wrong.

Aha! Thanks for tracking this down. We had a patch to fix this but were confused why the bug hadn't been noticed before. So it looks like it wasn't *present* before :)

johannes

Quoted 28 lines

Signed-off-by Harvey Harrison <[email protected]>

---
 net/mac80211/tkip.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

net/mac80211/tkip.c +2 -4

index dddbfd6..09093da 100644
@@ -230,10 +230,8 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 
        iv16 = data[hdr_len] << 8;
        iv16 += data[hdr_len + 2];
-       iv32 = data[hdr_len + 4] +
-               (data[hdr_len + 5] >> 8) +
-               (data[hdr_len + 6] >> 16) +
-               (data[hdr_len + 7] >> 24);
+       iv32 = data[hdr_len + 4] | (data[hdr_len + 5] << 8) |
+              (data[hdr_len + 6] << 16) | (data[hdr_len + 7] << 24);
 
 #ifdef CONFIG_TKIP_DEBUG
        printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",

Tomas Winkler

2008-04-27 15:00 UTC #2 lore raw

Quoted 8 lines · Johannes Berg

Quoted 2 lines · Harvey Harrison
Looks like 5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the shifts wrong.
Aha! Thanks for tracking this down. We had a patch to fix this but were confused why the bug hadn't been noticed before. So it looks like it wasn't *present* before :)

What to say.... Shame on me.
Tomas

Harvey Harrison

author

2008-04-27 17:43 UTC #3 lore raw

Quoted 6 lines · Tomas Winkler

Quoted 4 lines · Johannes Berg
Quoted 2 lines · Harvey Harrison
Looks like 5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the shifts wrong.

Quoted 6 lines

Quoted 4 lines
Aha! Thanks for tracking this down. We had a patch to fix this but were confused why the bug hadn't been noticed before. So it looks like it wasn't *present* before :)
What to say.... Shame on me.
Tomas

This is precisely why I wrote the new unaligned access helpers going in soon, I'll have this converted at that time.

This line will become:
iv32 = get_unaligned_le32(data + 4);

Harvey