Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 6 Oct 2021 10:36:22 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Kalle Valo <kvalo@codeaurora.org>
Cc:     "John W. Linville" <linville@tuxdriver.com>,
        Michael Buesch <mb@bu3sch.de>, linux-wireless@vger.kernel.org,
        b43-dev@lists.infradead.org, kernel-janitors@vger.kernel.org
Subject: [PATCH 2/2] b43: fix a lower bounds test
Message-ID: <20211006073621.GE8404@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20211006073542.GD8404@kili>
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?EUxIvrDmORY7QRPERUwRWt7ILR6kmZxw7+CTGo0iS7j9B0MKtxTMOQxPza6M?=
 =?us-ascii?Q?xkw9DLW5YppNw/DFIP13OvjfVRw8DTrFoUjXV1CDb2+aBqsuibydAY06wX0w?=
 =?us-ascii?Q?URmQAkSGVZ7ckRKd3l4OS9wpRTCkyBQkcqaZcjrFQzbKJYJlNDZW26Lu9DNv?=
 =?us-ascii?Q?izOhpozdBUR4M+9/+63Dbtdzij4bMEafdsXVQDgA5YER+QQTo37h01I/PAUE?=
 =?us-ascii?Q?5KYTRnp1onSPVktMPXpcTDKPtmebdAd8N8B9RmKTv7liC9YCnRBtWtrk0B3g?=
 =?us-ascii?Q?96Swr/FRT1CsHG7L7pv55OyJ2phg/bMAuUTEYXAzJeX7dBe4GCBQvZ4/Xjx2?=
 =?us-ascii?Q?DYy2hVzeUlzoNRgQKu8Jypo4OfJ0u7mIG64yS5cSkmwuyodcFtuRuahSd2lO?=
 =?us-ascii?Q?tDqKqJ8PwdfsRR8tQQrRWaf/80HuNHs5qe64my31pRLw6h4TzEiZk7/Qz+rN?=
 =?us-ascii?Q?7Pa9Z29ZbctuT8OlM3FQN6z/j1SjVCrj0Dk0b9PbpEElebscAmcEpMSgrA0i?=
 =?us-ascii?Q?KdoQpzNS2BkpvEjI9NDTTTMrYu5RMrmJMxK2uTtGbJhQR2iwRe8HLxswup3T?=
 =?us-ascii?Q?aS3uprbtvhLuzaK83ksQ4Q+tb6NAhOPHTvBhGEjQLouzEE4vE1phjIf+2Ev2?=
 =?us-ascii?Q?hqyf2t4fmFs9c0kDs1QOcGhCYa7XUSXz+PhpGsPchJte7KleoihtSubixD9O?=
 =?us-ascii?Q?YqHsQtGPwbBqMQlyyhThQKw1OnwyYa4+pbfRFAe4R5jP859n5OTuON3i3Ncp?=
 =?us-ascii?Q?Q/yIjUVuPeEctFBpOnCHeBEaato/E6HpJb7omoyllkzaJvi2gz8eRgDHsvY9?=
 =?us-ascii?Q?Fj+9050ONMRJUdTqpQLLKL6y3+4Rtjy2gqnK2bwSd18KgYw+vKvMs6iSp/0O?=
 =?us-ascii?Q?erLSd21zvAWDjIteeEUhzTnEE2R5VTTYMC0Vxp6PfJu3GzcpVbbVKvWh2lKm?=
 =?us-ascii?Q?Jf9rPXD9KJ0eyipWvdLxcumIQi8vLgt9/0KQvBKDsFUsMhi+/fNZ3gUfPzJ9?=
 =?us-ascii?Q?brlGgbwYqQ4pQLDLKTE6oPR58MJXcCGICrpA5u/wnomjAA+aKJ847+YFEySt?=
 =?us-ascii?Q?OJcqGZsMCyTYbBb6tLzstxptBX5fF6uHUT95jGH28dscuH1DfmD1xmIO7In3?=
 =?us-ascii?Q?tm8F2Y8I5SNEUkwfnOs0LrtfRtqOcCIpaoDsQSMWL3F6i9I5kUiP5OqNS3Jg?=
 =?us-ascii?Q?zJNKTqMl1Zu0JUx92aLMujVv3Lz2+JjekH/0UxMOW0qHH9FhPhdXsUUi/YMV?=
 =?us-ascii?Q?0FYU/tB1dCD9RfnsRVi3G1mIYA10wtePSNBMrjOhd6jewQ2n4yCaB7PjrFLy?=
 =?us-ascii?Q?VI2JujyVeJYxck+I9vpeNVP9?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f6af2a66-753e-4e12-ec17-08d9889c0506
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Oct 2021 07:36:33.1440
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: zrLnFwD2r3C6fqtm1ZhmfOgjoCIdGqjZrPZL6IvUbIFyUoBXopSMMCT54w/DZnmah4aq+JH6HEeeXQOxTx7p3iam2AyBEEJpmCGwbcZ4Hjg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4546
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10128 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 mlxlogscore=999 adultscore=0
 bulkscore=0 suspectscore=0 malwarescore=0 spamscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109230001
 definitions=main-2110060047
X-Proofpoint-GUID: 4Ic2UQjB61Sjm7jCkVqLO6u7bPt3GDHe
X-Proofpoint-ORIG-GUID: 4Ic2UQjB61Sjm7jCkVqLO6u7bPt3GDHe
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

The problem is that "channel" is an unsigned int, when it's less 5 the
value of "channel - 5" is not a negative number as one would expect but
is very high positive value instead.

This means that "start" becomes a very high positive value.  The result
of that is that we never enter the "for (i = start; i <= end; i++) {"
loop.  Instead of storing the result from b43legacy_radio_aci_detect()
it just uses zero.

Fixes: ef1a628d83fc ("b43: Implement dynamic PHY API")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/wireless/broadcom/b43/phy_g.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c
index d5a1a5c58236..ac72ca39e409 100644
--- a/drivers/net/wireless/broadcom/b43/phy_g.c
+++ b/drivers/net/wireless/broadcom/b43/phy_g.c
@@ -2297,7 +2297,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev)
 	b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF);
 	b43_set_all_gains(dev, 3, 8, 1);
 
-	start = (channel - 5 > 0) ? channel - 5 : 1;
+	start = (channel > 5) ? channel - 5 : 1;
 	end = (channel + 5 < 14) ? channel + 5 : 13;
 
 	for (i = start; i <= end; i++) {
-- 
2.20.1