[bug report] wifi: mt76: move mt76_rate_power from core to mt76x02 driver code

From: Dan Carpenter <hidden>
Date: 2022-12-03 12:09:49

Hello Felix Fietkau,

The patch b376d96362d8: "wifi: mt76: move mt76_rate_power from core
to mt76x02 driver code" from Sep 28, 2022, leads to the following
Smatch static checker warning:

	drivers/net/wireless/mediatek/mt76/mt76x0/phy.c:645 mt76x0_phy_get_target_power()
	error: buffer overflow 'dev->rate_power.vht' 2 <= 9

drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
    635                 *target_power = cur_power + dev->rate_power.ofdm[index];
    636                 *target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 0, index + 4);
    637                 break;
    638         }
    639         case 4:
    640                 /* vht rates */
    641                 tx_rate = info[1] & 0xf;
    642                 if (tx_rate > 9)
                            ^^^^^^^^^^^

    643                         return -EINVAL;
    644 
--> 645                 *target_power = cur_power + dev->rate_power.vht[tx_rate];

In the original code this was a 10 element array but now it's only 2
elements.

    646                 *target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate);
    647                 break;
    648         default:
    649                 /* ht rates */
    650                 tx_rate = info[1] & 0x7f;
    651                 if (tx_rate > 9)
    652                         return -EINVAL;
    653 
    654                 *target_power = cur_power + dev->rate_power.ht[tx_rate];
    655                 *target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate);
    656                 break;
    657         }
    658 
    659         return 0;
    660 }

regards,
dan carpenter
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help