From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 10 May 2016 19:21:17 +0000 (+0300)
Subject: atmel: potential underflow in atmel_set_freq()
X-Git-Tag: v4.7-rc1~96^2~8^2~1
X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=d9739a26fbcaa11c026dd79bc310af96003f20d8;p=linux-2.6-block.git

atmel: potential underflow in atmel_set_freq()

Smatch complains that we cap the upper bound of "fwrq->m" but not the
lower bound.  I don't know if it can actually happen but it's simple
enough to check for negatives.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---

diff --git a/drivers/net/wireless/atmel/atmel.c b/drivers/net/wireless/atmel/atmel.c
index 8f8f37f3a00c..bf2e9a083c0c 100644
--- a/drivers/net/wireless/atmel/atmel.c
+++ b/drivers/net/wireless/atmel/atmel.c
@@ -2275,7 +2275,7 @@ static int atmel_set_freq(struct net_device *dev,
 		fwrq->m = ieee80211_frequency_to_channel(f);
 	}
 	/* Setting by channel number */
-	if ((fwrq->m > 1000) || (fwrq->e > 0))
+	if (fwrq->m < 0 || fwrq->m > 1000 || fwrq->e > 0)
 		rc = -EOPNOTSUPP;
 	else {
 		int channel = fwrq->m;