Smatch complains about iwlagn_rx_calib_result() it would be bad for
"len" to be negative.
drivers/net/wireless/iwlwifi/iwl-ucode.c
299 int iwlagn_rx_calib_result(struct iwl_priv *priv,
300 struct iwl_rx_mem_buffer *rxb,
301 struct iwl_device_cmd *cmd)
302 {
303 struct iwl_rx_packet *pkt = rxb_addr(rxb);
304 struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
305 int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
306
307 /* reduce the size of the length field itself */
308 len -= 4;
^^^^^^^^
Where does this 4 come from? I've tried to determine what the minimum
size of "le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK" is but
I got lost. Can it ever be less than 4?
309
310 if (iwl_calib_set(priv, hdr, len))
311 IWL_ERR(priv, "Failed to record calibration data %d\n",
312 hdr->op_code);
313
314 return 0;
315 }
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
