linux-kernel - [PATCH] brcmsmac: fix shift on 4 bit masked value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 Mar 2021 16:45:13 +0000
From:   Colin King <colin.king@...onical.com>
To:     Arend van Spriel <aspriel@...il.com>,
        Franky Lin <franky.lin@...adcom.com>,
        Hante Meuleman <hante.meuleman@...adcom.com>,
        Chi-hsien Lin <chi-hsien.lin@...ineon.com>,
        Wright Feng <wright.feng@...ineon.com>,
        Chung-hsien Hsu <chung-hsien.hsu@...ineon.com>,
        Kalle Valo <kvalo@...eaurora.org>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        linux-wireless@...r.kernel.org,
        brcm80211-dev-list.pdl@...adcom.com,
        SHA-cyfmac-dev-list@...ineon.com, netdev@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] brcmsmac: fix shift on 4 bit masked value

From: Colin Ian King <colin.king@...onical.com>

The calculation of offtune_val seems incorrect, the u16 value in
pi->tx_rx_cal_radio_saveregs[2] is being masked with 0xf0 and then
shifted 8 places right so that always ends up as a zero result. I
believe the intended shift was 4 bits to the right. Fix this.

[Note: not tested, I don't have the H/W]

Addresses-Coverity: ("Operands don't affect result")
Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index 8580a2754789..2c04bae6e21c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -26329,7 +26329,7 @@ static void wlc_phy_rxcal_radio_setup_nphy(struct brcms_phy *pi, u8 rx_core)
 
 					offtune_val =
 						(pi->tx_rx_cal_radio_saveregs
-						 [2] & 0xF0) >> 8;
+						 [2] & 0xF0) >> 4;
 					offtune_val =
 						(offtune_val <= 0x7) ? 0xF : 0;
 
-- 
2.30.2