Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 21 Apr 2021 13:20:10 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     ryder.lee@mediatek.com
Cc:     linux-wireless@vger.kernel.org, linux-mediatek@lists.infradead.org
Subject: [bug report] mt76: mt7615: fix CSA notification for DBDC
Message-ID: <YH/8WvgUZtp51WEP@mwanda>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Precedence: bulk

Hello Ryder Lee,

The patch 402a695b1ae6: "mt76: mt7615: fix CSA notification for DBDC"
from Feb 27, 2021, leads to the following static checker warning:

	drivers/net/wireless/mediatek/mt76/mt7615/mcu.c:385 mt7615_mcu_rx_csa_notify()
	error: undefined (user controlled) shift '(((1))) << (c->omac_idx)'

drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
   376  static void
   377  mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
   378  {
   379          struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
   380          struct mt76_phy *mphy = &dev->mt76.phy;
   381          struct mt7615_mcu_csa_notify *c;
   382  
   383          c = (struct mt7615_mcu_csa_notify *)skb->data;
                ^                                   ^^^^^^^^^
c is random data from the network

   384  
   385          if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
                                                            ^^^^^^^^^^^
Any value more than 61 will lead to undefined behavior.  (shift wrapping
mostly).

   386                  mphy = dev->mt76.phy2;
   387  
   388          ieee80211_iterate_active_interfaces_atomic(mphy->hw,
   389                          IEEE80211_IFACE_ITER_RESUME_ALL,
   390                          mt7615_mcu_csa_finish, mphy->hw);
   391  }

regards,
dan carpenter