| Message ID | 9b3b92d6-3672-00be-d0b5-ccd222236ba9@gmail.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Johannes Berg |
| Headers | show |
| Series | [1/2] staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi. | expand |
On Sun, Feb 02, 2020 at 12:27:25PM +0000, Malcolm Priestley wrote: > bb_pre_ed_rssi is an u8 rx_dm always returns negative signed > values add minus operator to always yield positive. > > fixes issue where rx sensitivity is always set to maximum because > the unsigned numbers were always greater then 100. > > Cc: stable <stable@vger.kernel.org> Can you add a Fixes tag for stable kernels? Fixes: 63b9907f58f1 ("staging: vt6656: mac80211 conversion: create rx function.") Otherwise we don't backport it far enough and then it becomes an actively exploited Android vulnerability and Google writes an article about it. Then everyone gets annoyed with us and shakes their head because OpenBSD never has Android vulnerabilities etc... > Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> > --- > drivers/staging/vt6656/dpc.c | 2 +- It appears that the vt6655 driver has the same issue. regards, dan carpenter
On 03/02/2020 09:42, Dan Carpenter wrote: > On Sun, Feb 02, 2020 at 12:27:25PM +0000, Malcolm Priestley wrote: >> bb_pre_ed_rssi is an u8 rx_dm always returns negative signed >> values add minus operator to always yield positive. >> >> fixes issue where rx sensitivity is always set to maximum because >> the unsigned numbers were always greater then 100. >> >> Cc: stable <stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> >> --- ... >> drivers/staging/vt6656/dpc.c | 2 +- > > It appears that the vt6655 driver has the same issue. In the vt6655 it is not used. Regards Malcolm
diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c index 821aae8ca402..a0b60e7d1086 100644 --- a/drivers/staging/vt6656/dpc.c +++ b/drivers/staging/vt6656/dpc.c @@ -98,7 +98,7 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb, vnt_rf_rssi_to_dbm(priv, tail->rssi, &rx_dbm); - priv->bb_pre_ed_rssi = (u8)rx_dbm + 1; + priv->bb_pre_ed_rssi = (u8)-rx_dbm + 1; priv->current_rssi = priv->bb_pre_ed_rssi; skb_pull(skb, sizeof(*head));
bb_pre_ed_rssi is an u8 rx_dm always returns negative signed values add minus operator to always yield positive. fixes issue where rx sensitivity is always set to maximum because the unsigned numbers were always greater then 100. Cc: stable <stable@vger.kernel.org> Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> --- drivers/staging/vt6656/dpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)