wlan: sanitize net device event flags
Static source code analysis identified an issue that the pAdapter
event_flags field can overflow. The cause is that the individual
flags were defined as bit masks, but they were being primarily used as
bit numbers. Change the definition of the event flags so they have
"bit number" semantics, and change the usage of DEVICE_IFACE_OPENED
(the only one that was being used with "bit mask" semantics) to also
use "bit number" semantics.
Change-Id: I2b60ed31ca684a4b22da0f9e8cb23c5680da08cf
CRs-fixed: 470188
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 83a1794..7f497cd 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -1637,18 +1637,18 @@
status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
while ( (NULL != pAdapterNode) && (VOS_STATUS_SUCCESS == status) )
{
- if( pAdapterNode->pAdapter->event_flags & DEVICE_IFACE_OPENED)
- {
- hddLog(VOS_TRACE_LEVEL_INFO, "%s: chip already out of "
- "standby", __func__, pAdapter->device_mode);
- in_standby = FALSE;
- break;
- }
- else
- {
- status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
- pAdapterNode = pNext;
- }
+ if (test_bit(DEVICE_IFACE_OPENED, &pAdapterNode->pAdapter->event_flags))
+ {
+ hddLog(VOS_TRACE_LEVEL_INFO, "%s: chip already out of standby",
+ __func__, pAdapter->device_mode);
+ in_standby = FALSE;
+ break;
+ }
+ else
+ {
+ status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
+ pAdapterNode = pNext;
+ }
}
if (TRUE == in_standby)
@@ -1661,7 +1661,7 @@
}
}
- pAdapter->event_flags |= DEVICE_IFACE_OPENED;
+ set_bit(DEVICE_IFACE_OPENED, &pAdapter->event_flags);
if (hdd_connIsConnected(WLAN_HDD_GET_STATION_CTX_PTR(pAdapter)))
{
VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
@@ -1724,7 +1724,7 @@
return -ENODEV;
}
- pAdapter->event_flags &= ~(DEVICE_IFACE_OPENED);
+ clear_bit(DEVICE_IFACE_OPENED, &pAdapter->event_flags);
hddLog(VOS_TRACE_LEVEL_INFO, "%s: Disabling OS Tx queues", __func__);
netif_tx_disable(pAdapter->dev);
netif_carrier_off(pAdapter->dev);
@@ -1747,18 +1747,18 @@
status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
while ( (NULL != pAdapterNode) && (VOS_STATUS_SUCCESS == status) )
{
- if ( pAdapterNode->pAdapter->event_flags & DEVICE_IFACE_OPENED)
- {
- hddLog(VOS_TRACE_LEVEL_INFO, "%s: Still other ifaces are up cannot "
- "put device to sleep", __func__, pAdapter->device_mode);
- enter_standby = FALSE;
- break;
- }
- else
- {
- status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
- pAdapterNode = pNext;
- }
+ if (test_bit(DEVICE_IFACE_OPENED, &pAdapterNode->pAdapter->event_flags))
+ {
+ hddLog(VOS_TRACE_LEVEL_INFO, "%s: Still other ifaces are up cannot "
+ "put device to sleep", __func__, pAdapter->device_mode);
+ enter_standby = FALSE;
+ break;
+ }
+ else
+ {
+ status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
+ pAdapterNode = pNext;
+ }
}
if (TRUE == enter_standby)