atmel: potential underflow in atmel_set_freq()

PATCH In review Dan Carpenter 2 participants 2 messages May 10, 2016 – May 11, 2016

Subsystems (3)

Kernel janitors Networking drivers (wireless) Arm/Microchip (AT91) SoC support

lore

Share & tools

lore

Dan Carpenter

author

2016-05-10 19:21 UTC #0 lore raw

PATCH 1/1 atmel: potential underflow in atmel_set_freq()

Smatch complains that we cap the upper bound of "fwrq->m" but not the lower bound. I don't know if it can actually happen but it's simple enough to check for negatives.

Signed-off-by Dan Carpenter <[email protected]>

drivers/net/wireless/atmel/atmel.c +1 -1

index 8f8f37f..bf2e9a0 100644
@@ -2275,7 +2275,7 @@ static int atmel_set_freq(struct net_device *dev,
 		fwrq->m = ieee80211_frequency_to_channel(f);
 	}
 	/* Setting by channel number */
-	if ((fwrq->m > 1000) || (fwrq->e > 0))
+	if (fwrq->m < 0 || fwrq->m > 1000 || fwrq->e > 0)
 		rc = -EOPNOTSUPP;
 	else {
 		int channel = fwrq->m;

Kalle Valo

2016-05-11 19:03 UTC #1 lore raw

Quoted 5 lines · Dan Carpenter

Smatch complains that we cap the upper bound of "fwrq->m" but not the lower bound. I don't know if it can actually happen but it's simple enough to check for negatives.
Signed-off-by Dan Carpenter <[email protected]>

Thanks, 1 patch applied to wireless-drivers-next.git:

d9739a26fbca atmel: potential underflow in atmel_set_freq()

Signature · 2 lines

Sent by pwcli
https://patchwork.kernel.org/patch/9061371/