From: Andrey Vatoropin <a.vatoropin@xxxxxxx>
Size of variable peer_stats->succ_bytes equals four bytes.
Size of variable peer_stats->retry_bytes equals four bytes.
The expression peer_stats->succ_bytes+peer_stats->retry_bytes is currently
being evaluated using 32-bit arithmetic. So during the addition an
overflow may occur.
Since a value of type 'u64' is used to store the eventual he, it is
necessary to perform the 64-bit arithmetic to avoid overflow during the
multiplication.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Andrey Vatoropin <a.vatoropin@xxxxxxx>
---
drivers/net/wireless/ath/ath11k/debugfs_sta.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/debugfs_sta.c b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
index f56a24b6c8da..982a7add6ea6 100644
--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
@@ -69,26 +69,26 @@ void ath11k_debugfs_sta_add_tx_stats(struct ath11k_sta *arsta,
if (txrate->flags & RATE_INFO_FLAGS_HE_MCS) {
STATS_OP_FMT(AMPDU).he[0][mcs] +=
- peer_stats->succ_bytes + peer_stats->retry_bytes;
+ peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
STATS_OP_FMT(AMPDU).he[1][mcs] +=
peer_stats->succ_pkts + peer_stats->retry_pkts;
} else if (txrate->flags & RATE_INFO_FLAGS_MCS) {
STATS_OP_FMT(AMPDU).ht[0][mcs] +=
- peer_stats->succ_bytes + peer_stats->retry_bytes;
+ peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
STATS_OP_FMT(AMPDU).ht[1][mcs] +=
peer_stats->succ_pkts + peer_stats->retry_pkts;
} else {
STATS_OP_FMT(AMPDU).vht[0][mcs] +=
- peer_stats->succ_bytes + peer_stats->retry_bytes;
+ peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
STATS_OP_FMT(AMPDU).vht[1][mcs] +=
peer_stats->succ_pkts + peer_stats->retry_pkts;
}
STATS_OP_FMT(AMPDU).bw[0][bw] +=
- peer_stats->succ_bytes + peer_stats->retry_bytes;
+ peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
STATS_OP_FMT(AMPDU).nss[0][nss] +=
- peer_stats->succ_bytes + peer_stats->retry_bytes;
+ peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
STATS_OP_FMT(AMPDU).gi[0][gi] +=
- peer_stats->succ_bytes + peer_stats->retry_bytes;
+ peer_stats->succ_bytes + (u64)peer_stats->retry_bytes;
STATS_OP_FMT(AMPDU).bw[1][bw] +=
peer_stats->succ_pkts + peer_stats->retry_pkts;
STATS_OP_FMT(AMPDU).nss[1][nss] +=
--
2.43.0
