The type of tsf arithmetic is
u64 += u16 * int;
When (u16 * int) is larger than 0x7FFFFFFF, the value casting to u64 with
sign-extension will become all 1 in upper 32 bits part.
To meet the case, u16 value should be larger than 20491
(0x7FFFFFFF / 104800). Fortunately the meaning of 20491 is delay time of
WoWLAN net detection in unit of second, so 20491 seconds (5.7 hours)
might not a real case we can meet.
Addresses-Coverity-ID: 1620910 ("Unintended sign extension")
Signed-off-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
---
drivers/net/wireless/realtek/rtw89/fw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 752a3c2536d4..252812781514 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -4963,7 +4963,7 @@ int rtw89_fw_h2c_scan_offload_ax(struct rtw89_dev *rtwdev,
scan_mode = RTW89_SCAN_IMMEDIATE;
} else {
scan_mode = RTW89_SCAN_DELAY;
- tsf += option->delay * RTW89_SCAN_DELAY_TSF_UNIT;
+ tsf += (u64)option->delay * RTW89_SCAN_DELAY_TSF_UNIT;
}
}
--
2.25.1
