From: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> In https://bugzilla.kernel.org/show_bug.cgi?id=177341 Bob reported a UBSAN WARNING on rs.c in iwldvm. Fix the same bug in iwlmvm. This because i = index - 1; for (mask = (1 << i); i >= 0; i--, mask >>= 1) is unsafe: i could be negative and hence we can call << on a negative value. This bug doesn't have any real impact since the condition of the for loop will prevent any usage of mask. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=177341 Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> Signed-off-by: Luca Coelho <luciano.coelho@xxxxxxxxx> --- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c index 13be9a5b83ee..ce907c58ebf6 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c @@ -972,7 +972,9 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask, /* Find the previous rate that is in the rate mask */ i = index - 1; - for (mask = (1 << i); i >= 0; i--, mask >>= 1) { + if (i >= 0) + mask = BIT(i); + for (; i >= 0; i--, mask >>= 1) { if (rate_mask & mask) { low = i; break; -- 2.11.0
