commit 6a81ca469d7570251bae32df008bccc1b7329433
author Jeff Johnson <jjohnson@qca.qualcomm.com> Fri Apr 05 10:37:08 2013 -0700
committer Gopichand Nakkala <gnakkala@qca.qualcomm.com> Tue Apr 09 14:45:52 2013 -0700
tree 3bbff1ffe925618a46baf83ea38992296698f9fe
parent 92686de52e22022ccb178cd6c3d283e05d5f8bd5

wlan: sanitize net device event flags

Static source code analysis identified an issue that the pAdapter
event_flags field can overflow.  The cause is that the individual
flags were defined as bit masks, but they were being primarily used as
bit numbers.  Change the definition of the event flags so they have
"bit number" semantics, and change the usage of DEVICE_IFACE_OPENED
(the only one that was being used with "bit mask" semantics) to also
use "bit number" semantics.

Change-Id: I2b60ed31ca684a4b22da0f9e8cb23c5680da08cf
CRs-fixed: 470188

CORE/HDD/src/wlan_hdd_main.c

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 83a1794..7f497cd 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -1637,18 +1637,18 @@
    status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
    while ( (NULL != pAdapterNode) && (VOS_STATUS_SUCCESS == status) )
    {
-        if( pAdapterNode->pAdapter->event_flags & DEVICE_IFACE_OPENED)
-        {
-            hddLog(VOS_TRACE_LEVEL_INFO, "%s: chip already out of " 
-                  "standby", __func__, pAdapter->device_mode);
-            in_standby = FALSE;
-            break;
-        }
-        else
-        {
-            status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
-            pAdapterNode = pNext;
-        }
+      if (test_bit(DEVICE_IFACE_OPENED, &pAdapterNode->pAdapter->event_flags))
+      {
+         hddLog(VOS_TRACE_LEVEL_INFO, "%s: chip already out of standby",
+                __func__, pAdapter->device_mode);
+         in_standby = FALSE;
+         break;
+      }
+      else
+      {
+         status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
+         pAdapterNode = pNext;
+      }
    }
  
    if (TRUE == in_standby)
@@ -1661,7 +1661,7 @@
        }
    }
    
-   pAdapter->event_flags |= DEVICE_IFACE_OPENED;
+   set_bit(DEVICE_IFACE_OPENED, &pAdapter->event_flags);
    if (hdd_connIsConnected(WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))) 
    {
        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
@@ -1724,7 +1724,7 @@
       return -ENODEV;
    }
 
-   pAdapter->event_flags &= ~(DEVICE_IFACE_OPENED);
+   clear_bit(DEVICE_IFACE_OPENED, &pAdapter->event_flags);
    hddLog(VOS_TRACE_LEVEL_INFO, "%s: Disabling OS Tx queues", __func__);
    netif_tx_disable(pAdapter->dev);
    netif_carrier_off(pAdapter->dev);
@@ -1747,18 +1747,18 @@
    status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
    while ( (NULL != pAdapterNode) && (VOS_STATUS_SUCCESS == status) )
    {
-        if ( pAdapterNode->pAdapter->event_flags & DEVICE_IFACE_OPENED)
-        {
-            hddLog(VOS_TRACE_LEVEL_INFO, "%s: Still other ifaces are up cannot "
-                   "put device to sleep", __func__, pAdapter->device_mode);
-            enter_standby = FALSE;
-            break;
-        }
-        else
-        { 
-            status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
-            pAdapterNode = pNext;
-        }
+      if (test_bit(DEVICE_IFACE_OPENED, &pAdapterNode->pAdapter->event_flags))
+      {
+         hddLog(VOS_TRACE_LEVEL_INFO, "%s: Still other ifaces are up cannot "
+                "put device to sleep", __func__, pAdapter->device_mode);
+         enter_standby = FALSE;
+         break;
+      }
+      else
+      {
+         status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
+         pAdapterNode = pNext;
+      }
    }
 
    if (TRUE == enter_standby)