2015-12-02 02:50:15

by Mario J. Rugiero

Subject: [PATCH 1/1] staging: Fix bitshifts by wrong offsets in wilc1000/host_interface.c

struct set_multicast uses (implicitly) sizeof(bool) to determine how many bytes to copy in
Handle_SetMulticastFilter. Since that is implementation defined, it triggered sparse to
rightfully complain about shifting a bigger value than supported.
Since it was used as if assuming it was 32 bits, I replaced the bool member by a u32.
Also, time_out and buf_size members of ba_session_info are u16, but while copying their
bytes into ptr in Handle_AddBASession shift 16 bits for the second byte instead of 8 bits.
This patch fixes those two issues.

Signed-off-by: Mario J. Rugiero <[email protected]>
---
drivers/staging/wilc1000/host_interface.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 0c87f6c..fcfd70a 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -142,7 +142,7 @@ struct beacon_attr {
};

struct set_multicast {
- bool enabled;
+ u32 enabled;
u32 cnt;
};

@@ -2752,9 +2752,9 @@ static s32 Handle_AddBASession(struct host_if_drv *hif_drv,
*ptr++ = strHostIfBASessionInfo->tid;
*ptr++ = 1;
*ptr++ = (strHostIfBASessionInfo->buf_size & 0xFF);
- *ptr++ = ((strHostIfBASessionInfo->buf_size >> 16) & 0xFF);
+ *ptr++ = ((strHostIfBASessionInfo->buf_size >> 8) & 0xFF);
*ptr++ = (strHostIfBASessionInfo->time_out & 0xFF);
- *ptr++ = ((strHostIfBASessionInfo->time_out >> 16) & 0xFF);
+ *ptr++ = ((strHostIfBASessionInfo->time_out >> 8) & 0xFF);
*ptr++ = (AddbaTimeout & 0xFF);
*ptr++ = ((AddbaTimeout >> 16) & 0xFF);
*ptr++ = 8;
@@ -2777,7 +2777,7 @@ static s32 Handle_AddBASession(struct host_if_drv *hif_drv,
*ptr++ = strHostIfBASessionInfo->tid;
*ptr++ = 8;
*ptr++ = (strHostIfBASessionInfo->buf_size & 0xFF);
- *ptr++ = ((strHostIfBASessionInfo->time_out >> 16) & 0xFF);
+ *ptr++ = ((strHostIfBASessionInfo->time_out >> 8) & 0xFF);
*ptr++ = 3;
result = send_config_pkt(SET_CFG, &wid, 1,
get_id_from_handler(hif_drv));
--
2.6.2

2015-12-19 01:16:14

by Mario J. Rugiero

Subject: Re: [PATCH 1/1] staging: Fix bitshifts by wrong offsets in wilc1000/host_interface.c

El 18/12/15 a las 19:50, Greg KH escribi?:
> On Tue, Dec 01, 2015 at 11:49:55PM -0300, Mario J. Rugiero wrote:
>> struct set_multicast uses (implicitly) sizeof(bool) to determine how many bytes to copy in
>> Handle_SetMulticastFilter. Since that is implementation defined, it triggered sparse to
>> rightfully complain about shifting a bigger value than supported.
>> Since it was used as if assuming it was 32 bits, I replaced the bool member by a u32.
>> Also, time_out and buf_size members of ba_session_info are u16, but while copying their
>> bytes into ptr in Handle_AddBASession shift 16 bits for the second byte instead of 8 bits.
>> This patch fixes those two issues.
>>
>> Signed-off-by: Mario J. Rugiero <[email protected]>
>> ---
>> drivers/staging/wilc1000/host_interface.c | 8 ++++----
>> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> How did you test this is correct?
>
> Doesn't apply to my tree :(
>
> thanks,
>
> greg k-h
>

Because I lack the hardware, I only tested it built with allmodconfig
and tried to be very careful about my reasoning. I know I *should* be
testing it, and am sorry about it.
Should I try and update the patch? Maybe it conflicts with a different
one. I made the changes on top of staging-testing.
In retrospect, I believe the issues should be handled in different
patches anyway, so I would like to do a second version anyway.

Regards,
Mario.

2015-12-19 00:44:35

by Greg Kroah-Hartman

Subject: Re: [PATCH 1/1] staging: Fix bitshifts by wrong offsets in wilc1000/host_interface.c

On Tue, Dec 01, 2015 at 11:49:55PM -0300, Mario J. Rugiero wrote:
> struct set_multicast uses (implicitly) sizeof(bool) to determine how many bytes to copy in
> Handle_SetMulticastFilter. Since that is implementation defined, it triggered sparse to
> rightfully complain about shifting a bigger value than supported.
> Since it was used as if assuming it was 32 bits, I replaced the bool member by a u32.
> Also, time_out and buf_size members of ba_session_info are u16, but while copying their
> bytes into ptr in Handle_AddBASession shift 16 bits for the second byte instead of 8 bits.
> This patch fixes those two issues.
>
> Signed-off-by: Mario J. Rugiero <[email protected]>
> ---
> drivers/staging/wilc1000/host_interface.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)

How did you test this is correct?

Doesn't apply to my tree :(

thanks,

greg k-h