Module Name: src
Committed By: msaitoh
Date: Thu Jul 25 14:31:35 UTC 2019
Modified Files:
src/sys/dev/ic: rtwnreg.h
src/sys/dev/usb: if_urtwn.c
Log Message:
Avoid undefined behavior. Found by KUBSan.
To generate a diff of this commit:
cvs rdiff -u -r1.1 -r1.2 src/sys/dev/ic/rtwnreg.h
cvs rdiff -u -r1.70 -r1.71 src/sys/dev/usb/if_urtwn.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/rtwnreg.h
diff -u src/sys/dev/ic/rtwnreg.h:1.1 src/sys/dev/ic/rtwnreg.h:1.2
--- src/sys/dev/ic/rtwnreg.h:1.1 Fri Jun 29 04:02:10 2018
+++ src/sys/dev/ic/rtwnreg.h Thu Jul 25 14:31:35 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: rtwnreg.h,v 1.1 2018/06/29 04:02:10 thorpej Exp $ */
+/* $NetBSD: rtwnreg.h,v 1.2 2019/07/25 14:31:35 msaitoh Exp $ */
/* $OpenBSD: r92creg.h,v 1.16 2017/09/22 13:41:56 kevlo Exp $ */
/*-
@@ -1031,7 +1031,8 @@
/* Macros to access unaligned little-endian memory. */
#define LE_READ_2(x) ((x)[0] | ((x)[1] << 8))
-#define LE_READ_4(x) ((x)[0] | ((x)[1] << 8) | ((x)[2] << 16) | ((x)[3] << 24))
+#define LE_READ_4(x) ((x)[0] | ((x)[1] << 8) | ((x)[2] << 16) | \
+ ((uint32_t)((x)[3]) << 24))
/*
* Macros to access subfields in registers.
Index: src/sys/dev/usb/if_urtwn.c
diff -u src/sys/dev/usb/if_urtwn.c:1.70 src/sys/dev/usb/if_urtwn.c:1.71
--- src/sys/dev/usb/if_urtwn.c:1.70 Sat Jun 15 04:00:17 2019
+++ src/sys/dev/usb/if_urtwn.c Thu Jul 25 14:31:35 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: if_urtwn.c,v 1.70 2019/06/15 04:00:17 msaitoh Exp $ */
+/* $NetBSD: if_urtwn.c,v 1.71 2019/07/25 14:31:35 msaitoh Exp $ */
/* $OpenBSD: if_urtwn.c,v 1.42 2015/02/10 23:25:46 mpi Exp $ */
/*-
@@ -25,7 +25,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.70 2019/06/15 04:00:17 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.71 2019/07/25 14:31:35 msaitoh Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -1092,13 +1092,13 @@ urtwn_fw_cmd(struct urtwn_softc *sc, uin
&cp[1], 2);
urtwn_write_4(sc, R92C_HMEBOX(fwcur),
cp[0] + (cp[3] << 8) + (cp[4] << 16) +
- (cp[5] << 24));
+ ((uint32_t)cp[5] << 24));
} else {
urtwn_write_region(sc, R92E_HMEBOX_EXT(fwcur),
&cp[4], 2);
urtwn_write_4(sc, R92C_HMEBOX(fwcur),
cp[0] + (cp[1] << 8) + (cp[2] << 16) +
- (cp[3] << 24));
+ ((uint32_t)cp[3] << 24));
}
} else {
urtwn_write_region(sc, R92C_HMEBOX(fwcur), cp, len);
