[PATCH] mac80211: incorrect shift direction

[PATCH] mac80211: incorrect shift direction

[Harvey Harrison]

Looks like  5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the
shifts wrong.

Noticed by sparse:
net/mac80211/tkip.c:234:25: warning: right shift by bigger than source value
net/mac80211/tkip.c:235:25: warning: right shift by bigger than source value
net/mac80211/tkip.c:236:25: warning: right shift by bigger than source value

Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
---
 net/mac80211/tkip.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index dddbfd6..09093da 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -230,10 +230,8 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 
 	iv16 = data[hdr_len] << 8;
 	iv16 += data[hdr_len + 2];
-	iv32 = data[hdr_len + 4] +
-		(data[hdr_len + 5] >> 8) +
-		(data[hdr_len + 6] >> 16) +
-		(data[hdr_len + 7] >> 24);
+	iv32 = data[hdr_len + 4] | (data[hdr_len + 5] << 8) |
+	       (data[hdr_len + 6] << 16) | (data[hdr_len + 7] << 24);
 
 #ifdef CONFIG_TKIP_DEBUG
 	printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
-- 
1.5.5.1.270.g89765

Re: [PATCH] mac80211: incorrect shift direction

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 1510 bytes --]

On Sun, 2008-04-27 at 03:48 -0700, Harvey Harrison wrote:
> Looks like  5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the
> shifts wrong.

Aha! Thanks for tracking this down. We had a patch to fix this but were
confused why the bug hadn't been noticed before. So it looks like it
wasn't *present* before :)

johannes


> 
> Noticed by sparse:
> net/mac80211/tkip.c:234:25: warning: right shift by bigger than source value
> net/mac80211/tkip.c:235:25: warning: right shift by bigger than source value
> net/mac80211/tkip.c:236:25: warning: right shift by bigger than source value
> 
> Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
> ---
>  net/mac80211/tkip.c |    6 ++----
>  1 files changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
> index dddbfd6..09093da 100644
> --- a/net/mac80211/tkip.c
> +++ b/net/mac80211/tkip.c
> @@ -230,10 +230,8 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
>  
>         iv16 = data[hdr_len] << 8;
>         iv16 += data[hdr_len + 2];
> -       iv32 = data[hdr_len + 4] +
> -               (data[hdr_len + 5] >> 8) +
> -               (data[hdr_len + 6] >> 16) +
> -               (data[hdr_len + 7] >> 24);
> +       iv32 = data[hdr_len + 4] | (data[hdr_len + 5] << 8) |
> +              (data[hdr_len + 6] << 16) | (data[hdr_len + 7] << 24);
>  
>  #ifdef CONFIG_TKIP_DEBUG
>         printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

Re: [PATCH] mac80211: incorrect shift direction

[Tomas Winkler]

On Sun, Apr 27, 2008 at 2:24 PM, Johannes Berg
<johannes@sipsolutions.net> wrote:
> On Sun, 2008-04-27 at 03:48 -0700, Harvey Harrison wrote:
>  > Looks like  5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the
>  > shifts wrong.
>
>  Aha! Thanks for tracking this down. We had a patch to fix this but were
>  confused why the bug hadn't been noticed before. So it looks like it
>  wasn't *present* before :)
>
What to say.... Shame on me.
Tomas

Re: [PATCH] mac80211: incorrect shift direction

[Harvey Harrison]

On Sun, 2008-04-27 at 18:00 +0300, Tomas Winkler wrote:
> On Sun, Apr 27, 2008 at 2:24 PM, Johannes Berg
> <johannes@sipsolutions.net> wrote:
> > On Sun, 2008-04-27 at 03:48 -0700, Harvey Harrison wrote:
> >  > Looks like  5d2cdcd4e85c5187db30a6b29f79fbbe59f39f78 got the
> >  > shifts wrong.
> >
> >  Aha! Thanks for tracking this down. We had a patch to fix this but were
> >  confused why the bug hadn't been noticed before. So it looks like it
> >  wasn't *present* before :)
> >
> What to say.... Shame on me.
> Tomas

This is precisely why I wrote the new unaligned access helpers going in
soon, I'll have this converted at that time.

This line will become:
iv32 = get_unaligned_le32(data + 4);

Harvey