]> www.infradead.org Git - nvme.git/commit
wifi: ath12k: fix reusing outside iterator in ath12k_wow_vif_set_wakeups()
authorBaochen Qiang <quic_bqiang@quicinc.com>
Mon, 22 Jul 2024 03:33:32 +0000 (11:33 +0800)
committerJohannes Berg <johannes.berg@intel.com>
Fri, 26 Jul 2024 10:33:38 +0000 (12:33 +0200)
commit189d7aae8f5a100b0db8b302debbd445475d01e6
treef39fda931a277da5d8d379e4522d2c7f7b9e5a7e
parent6873cc4416078202882691b424fcca5b5fb1a94d
wifi: ath12k: fix reusing outside iterator in ath12k_wow_vif_set_wakeups()

Smatch throws below warning:

drivers/net/wireless/ath/ath12k/wow.c:434 ath12k_wow_vif_set_wakeups()
warn: reusing outside iterator: 'i'

drivers/net/wireless/ath/ath12k/wow.c
    411         default:
    412                 break;
    413         }
    414
    415         for (i = 0; i < wowlan->n_patterns; i++) {
                            ^^^^^^^^^^^^^^^^^^^^^^
Here we loop until ->n_patterns

    416                 const struct cfg80211_pkt_pattern *eth_pattern = &patterns[i];
    417                 struct ath12k_pkt_pattern new_pattern = {};
    418
    419                 if (WARN_ON(eth_pattern->pattern_len > WOW_MAX_PATTERN_SIZE))
    420                         return -EINVAL;
    421
    422                 if (ar->ab->wow.wmi_conf_rx_decap_mode ==
    423                     ATH12K_HW_TXRX_NATIVE_WIFI) {
    424                         ath12k_wow_convert_8023_to_80211(ar, eth_pattern,
    425                                                          &new_pattern);
    426
    427                         if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))
    428                                 return -EINVAL;
    429                 } else {
    430                         memcpy(new_pattern.pattern, eth_pattern->pattern,
    431                                eth_pattern->pattern_len);
    432
    433                         /* convert bitmask to bytemask */
--> 434                         for (i = 0; i < eth_pattern->pattern_len; i++)
    435                                 if (eth_pattern->mask[i / 8] & BIT(i % 8))
    436                                         new_pattern.bytemask[i] = 0xff;

This loop re-uses i and the loop ends with i == eth_pattern->pattern_len.
This looks like a bug.

Change to use a new iterator 'j' for the inner loop to fix it.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4

Fixes: 4a3c212eee0e ("wifi: ath12k: add basic WoW functionalities")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/d4975b95-9c43-45af-a0ab-80253f18c7f2@stanley.mountain/
Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Link: https://patch.msgid.link/20240722033332.6273-1-quic_bqiang@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/ath/ath12k/wow.c