Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 6 Oct 2021 10:35:42 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Larry Finger <Larry.Finger@lwfinger.net>
Cc:     Kalle Valo <kvalo@codeaurora.org>, linux-wireless@vger.kernel.org,
        b43-dev@lists.infradead.org, kernel-janitors@vger.kernel.org
Subject: [PATCH 1/2] b43legacy: fix a lower bounds test
Message-ID: <20211006073542.GD8404@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?gfXFERSX2KeInulu95v3e8zyo1nf2yjpkD6RDxKSdIqnGXQniGnMzMs0uy4J?=
 =?us-ascii?Q?mg6m2+3TZlPeOiykYi14IW48X93CZHCkiKVht3LE/1ryrafZhy3gAuuWd8e9?=
 =?us-ascii?Q?ELGR9/RnTsBsREwIT96ay19Mp3Otv264eCTlfoDzRkut0rN7w0efqfAZF+fP?=
 =?us-ascii?Q?Oo5i2lj3rS7dy7M/p/2DqONsGjAwwJ/mLpanDsxFJKZjNqUjoWfWcymunyJD?=
 =?us-ascii?Q?fxxR+1Euj7AbxQzMOSD2A8YA4PyuNe8+9w9wWI5p1hs8hgyPuIPY2yHtUbJX?=
 =?us-ascii?Q?mPapjdFcxRyyrVVd3u3il/HGnB+YKwaj+Fge2LvM88IhDZtvptkw3zhgwGzH?=
 =?us-ascii?Q?Cxpc75BHp4gsA5vZ4A8cFmALvQLNZUOETV9P7gIfn12KtyI2ezpx+tA8wYhz?=
 =?us-ascii?Q?opjwatMsWKqu4uTqm6ANe9vFKXNxnDAn9U3d4cQS6/uNTalG3hQFt8ZLhfm6?=
 =?us-ascii?Q?nnQX+9wzRUImUH2sUsz36ezcl/xX3wZGr32QVrGnqIl3DBnnFNKei0LYZKEW?=
 =?us-ascii?Q?EWV4iRHNLt27eHRIhPHL+ZS/lFywWOpOfEZwWIU9DY2zb+dSfKpBoQJliTV3?=
 =?us-ascii?Q?Uk9vywHEXYqzZADYzGfAuEuQ5DbKTbuRNKig8cU2CWd9iWqJq0eVIv+40oW/?=
 =?us-ascii?Q?J/uT2CSj3S0kMze2P2hXSYXZBnc3wHQ8PnQ0nH7ohDbFY3c0eMr5UQgZBJmH?=
 =?us-ascii?Q?Axuj6KPkWb6PVP5dvEhJdVoyrMP4bzgtw6uRmdF1e3uY60QWNGP1x9bAWVjR?=
 =?us-ascii?Q?YvXdp+NaQ6Yyyp+MPckFUyxcFK7w3CAC0BfMrJbewPoejNXwcxBMJSTpQ725?=
 =?us-ascii?Q?kVbv5HztV8A1tPadK/9JfsyLarhbhdB9T7X0RJTJ0SgGe1cJ2Rp9T2m9Z0bR?=
 =?us-ascii?Q?PENMqVFnkPzC1MYcNR/SO5px5r+d3Wc8Aa7pvlSQlN2AxXWSh15Ln8gMtX3i?=
 =?us-ascii?Q?wGc2m2TbiVPiiZvHSaeMRZTZXlbKwJC5FcfcUlCR/YEmdloW174kbMzN25ry?=
 =?us-ascii?Q?wxaTojOYCH6Z363WSv8B3/PgWBDm+7rdhhPtGHQ61MIlkyYJuoT+HpRuneJh?=
 =?us-ascii?Q?eLaMNGKdqcTq3ZpDkfhxJ9Mp9qnTBAvj6eK4FXgolbXY405OUFjdddGEe5Me?=
 =?us-ascii?Q?cVCptFf22kF22pcs68IVNX07haN8dAAQiv5O1mxuM08KvBCHY9VYaoIW0IC0?=
 =?us-ascii?Q?nU3URUCIUyKV/ozic8p+UQ8mZA4eGlwprdtNYeTTOQmiMs706ZPoGGpW6Vgn?=
 =?us-ascii?Q?8nTH0i1cSI/Q9uOKV6rteuzk9E8MeUQJGe6PeIj/6VZ7f0hn/LjZxebK0Dxx?=
 =?us-ascii?Q?syC0Y6d8tFnn3CiACpibCuej?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d4abeda4-e3fd-4aa1-f352-08d9889bed78
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Oct 2021 07:35:53.6160
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: uvQw3Nn9zei0eZaeI4kW50pO4dfm/W2G/fYXhqwUvtferPNVtl58oV3saFNhqBl1wZn4lHv3oscyppDKE7r2D/vRagBM8mxRclDSSDFICj8=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4546
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10128 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 phishscore=0 malwarescore=0 bulkscore=0 mlxlogscore=999 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2109230001 definitions=main-2110060047
X-Proofpoint-ORIG-GUID: X4bQUUsQEeSlARoUhxY49asyD6mNSQQ2
X-Proofpoint-GUID: X4bQUUsQEeSlARoUhxY49asyD6mNSQQ2
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

The problem is that "channel" is an unsigned int, when it's less 5 the
value of "channel - 5" is not a negative number as one would expect but
is very high positive value instead.

This means that "start" becomes a very high positive value.  The result
of that is that we never enter the "for (i = start; i <= end; i++) {"
loop.  Instead of storing the result from b43legacy_radio_aci_detect()
it just uses zero.

Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This fix is correct, but making dead code go live can sometimes expose
bugs which were previously hiding and is always carries a slight risk.

 drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c
index 06891b4f837b..fdf78c10a05c 100644
--- a/drivers/net/wireless/broadcom/b43legacy/radio.c
+++ b/drivers/net/wireless/broadcom/b43legacy/radio.c
@@ -283,7 +283,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev)
 			    & 0x7FFF);
 	b43legacy_set_all_gains(dev, 3, 8, 1);
 
-	start = (channel - 5 > 0) ? channel - 5 : 1;
+	start = (channel > 5) ? channel - 5 : 1;
 	end = (channel + 5 < 14) ? channel + 5 : 13;
 
 	for (i = start; i <= end; i++) {
-- 
2.20.1