Commit 5cafd378 authored by Kees Cook's avatar Kees Cook Committed by Johannes Berg
Browse files

mac80211: radiotap: Use BIT() instead of shifts 



IEEE80211_RADIOTAP_EXT has a value of 31, which means if shift was ever
cast to 64-bit, the result would become sign-extended. As a matter of
robustness, just replace all the open-coded shifts with BIT().

Suggested-by: default avatarDavid Sterba <dsterba@suse.cz>
Link: https://lore.kernel.org/lkml/20210728092323.GW5047@twin.jikos.cz/


Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210806215112.2874773-1-keescook@chromium.org


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 0323689d

net/mac80211/rx.c

+11 −11
Original line number Diff line number Diff line
@@ -372,7 +372,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
			ieee80211_calculate_rx_timestamp(local, status,

							 mpdulen, 0),

			pos);

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));

		pos += 8;

	}
@@ -396,7 +396,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
		*pos = 0;

	} else {

		int shift = 0;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));

		if (status->bw == RATE_INFO_BW_10)

			shift = 1;

		else if (status->bw == RATE_INFO_BW_5)
@@ -433,7 +433,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {

		*pos = status->signal;

		rthdr->it_present |=

			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);

			cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));

		pos++;

	}
@@ -459,7 +459,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
	if (status->encoding == RX_ENC_HT) {

		unsigned int stbc;



		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));

		*pos++ = local->hw.radiotap_mcs_details;

		*pos = 0;

		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
@@ -483,7 +483,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
		while ((pos - (u8 *)rthdr) & 3)

			pos++;

		rthdr->it_present |=

			cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);

			cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));

		put_unaligned_le32(status->ampdu_reference, pos);

		pos += 4;

		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
@@ -510,7 +510,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
	if (status->encoding == RX_ENC_VHT) {

		u16 known = local->hw.radiotap_vht_details;



		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));

		put_unaligned_le16(known, pos);

		pos += 2;

		/* flags */
@@ -554,7 +554,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
		u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;



		rthdr->it_present |=

			cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP);

			cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));



		/* ensure 8 byte alignment */

		while ((pos - (u8 *)rthdr) & 7)
@@ -642,7 +642,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
		/* ensure 2 byte alignment */

		while ((pos - (u8 *)rthdr) & 1)

			pos++;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));

		memcpy(pos, &he, sizeof(he));

		pos += sizeof(he);

	}
@@ -652,14 +652,14 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
		/* ensure 2 byte alignment */

		while ((pos - (u8 *)rthdr) & 1)

			pos++;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE_MU);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));

		memcpy(pos, &he_mu, sizeof(he_mu));

		pos += sizeof(he_mu);

	}



	if (status->flag & RX_FLAG_NO_PSDU) {

		rthdr->it_present |=

			cpu_to_le32(1 << IEEE80211_RADIOTAP_ZERO_LEN_PSDU);

			cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));

		*pos++ = status->zero_length_psdu_type;

	}
@@ -667,7 +667,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 
		/* ensure 2 byte alignment */

		while ((pos - (u8 *)rthdr) & 1)

			pos++;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_LSIG);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));

		memcpy(pos, &lsig, sizeof(lsig));

		pos += sizeof(lsig);

	}

net/mac80211/status.c

+8 −8
Original line number Diff line number Diff line
@@ -305,8 +305,8 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local, 
	memset(rthdr, 0, rtap_len);

	rthdr->it_len = cpu_to_le16(rtap_len);

	rthdr->it_present =

		cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |

			    (1 << IEEE80211_RADIOTAP_DATA_RETRIES));

		cpu_to_le32(BIT(IEEE80211_RADIOTAP_TX_FLAGS) |

			    BIT(IEEE80211_RADIOTAP_DATA_RETRIES));

	pos = (unsigned char *)(rthdr + 1);



	/*
@@ -331,7 +331,7 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local, 
			sband->bitrates[info->status.rates[0].idx].bitrate;



	if (legacy_rate) {

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));

		*pos = DIV_ROUND_UP(legacy_rate, 5 * (1 << shift));

		/* padding for tx flags */

		pos += 2;
@@ -358,7 +358,7 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local, 


	if (status && status->rate &&

	    (status->rate->flags & RATE_INFO_FLAGS_MCS)) {

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));

		pos[0] = IEEE80211_RADIOTAP_MCS_HAVE_MCS |

			 IEEE80211_RADIOTAP_MCS_HAVE_GI |

			 IEEE80211_RADIOTAP_MCS_HAVE_BW;
@@ -374,7 +374,7 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local, 
			(IEEE80211_RADIOTAP_VHT_KNOWN_GI |

			 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH);



		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));



		/* required alignment from rthdr */

		pos = (u8 *)rthdr + ALIGN(pos - (u8 *)rthdr, 2);
@@ -419,7 +419,7 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local, 
		   (status->rate->flags & RATE_INFO_FLAGS_HE_MCS)) {

		struct ieee80211_radiotap_he *he;



		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));



		/* required alignment from rthdr */

		pos = (u8 *)rthdr + ALIGN(pos - (u8 *)rthdr, 2);
@@ -495,7 +495,7 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local, 
	/* IEEE80211_RADIOTAP_MCS

	 * IEEE80211_RADIOTAP_VHT */

	if (info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));

		pos[0] = IEEE80211_RADIOTAP_MCS_HAVE_MCS |

			 IEEE80211_RADIOTAP_MCS_HAVE_GI |

			 IEEE80211_RADIOTAP_MCS_HAVE_BW;
@@ -512,7 +512,7 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local, 
			(IEEE80211_RADIOTAP_VHT_KNOWN_GI |

			 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH);



		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);

		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));



		/* required alignment from rthdr */

		pos = (u8 *)rthdr + ALIGN(pos - (u8 *)rthdr, 2);

net/wireless/radiotap.c

+2 −2
Original line number Diff line number Diff line
@@ -125,13 +125,13 @@ int ieee80211_radiotap_iterator_init( 


	/* find payload start allowing for extended bitmap(s) */



	if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {

	if (iterator->_bitmap_shifter & (BIT(IEEE80211_RADIOTAP_EXT))) {

		if ((unsigned long)iterator->_arg -

		    (unsigned long)iterator->_rtheader + sizeof(uint32_t) >

		    (unsigned long)iterator->_max_length)

			return -EINVAL;

		while (get_unaligned_le32(iterator->_arg) &

					(1 << IEEE80211_RADIOTAP_EXT)) {

					(BIT(IEEE80211_RADIOTAP_EXT))) {

			iterator->_arg += sizeof(uint32_t);



			/*