2008-03-02 15:21:10

by Adrian Bunk

[permalink] [raw]
Subject: ide_register_hw(): buggy code

The Coverity checker spotted the following bogus change to
ide_register_hw() in commit 9e016a719209d95338e314b46c3012cc7feaaeec:

<-- snip -->

...
+ hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
+ index = hwif->index;
+ if (hwif)
+ goto found;
for (index = 0; index < MAX_HWIFS; index++)
...

<-- snip -->

It's impossible to reach the for() loop without Oopsing before.

Can you either fix this for 2.6.25 or push your patch that removes
ide_register_hw() for 2.6.25?

cu
Adrian

--

"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed


2008-03-03 16:03:22

by Peter Teoh

[permalink] [raw]
Subject: Re: ide_register_hw(): buggy code

On Sun, Mar 2, 2008 at 11:19 PM, Adrian Bunk <[email protected]> wrote:
> The Coverity checker spotted the following bogus change to
> ide_register_hw() in commit 9e016a719209d95338e314b46c3012cc7feaaeec:
>
> <-- snip -->
>
> ...
> + hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
> + index = hwif->index;
> + if (hwif)
> + goto found;
> for (index = 0; index < MAX_HWIFS; index++)
> ...
>
> <-- snip -->
>
> It's impossible to reach the for() loop without Oopsing before.
>
> Can you either fix this for 2.6.25 or push your patch that removes
> ide_register_hw() for 2.6.25?
>

My question is:

a. why is "retry=1", and then the do while loop always end up the
loop being one round executed only? Why not just remove the while
loop entirely?

b. not sure if your statement above implied this, but checking for
hwif!=0 should be before index. ???

c. "index = hwif->index;" should not be there, but after "found".
Is that correct?

int ide_register_hw(hw_regs_t *hw, void (*quirkproc)(ide_drive_t *),
ide_hwif_t **hwifp)
{
int index, retry = 1;
ide_hwif_t *hwif;
u8 idx[4] = { 0xff, 0xff, 0xff, 0xff };

do {
hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
index = hwif->index;
if (hwif)
goto found;
for (index = 0; index < MAX_HWIFS; index++)
ide_unregister(index, 1, 1);
} while (retry--);
return -1;
found:
if (hwif->present)


The patch I am thinking goes something like this:

--- ide/ide.c 2008-03-03 20:10:28.000000000 +0800
+++ ide/ide_new.c 2008-03-04 00:09:46.000000000 +0800
@@ -661,20 +661,18 @@ EXPORT_SYMBOL_GPL(ide_deprecated_find_po
int ide_register_hw(hw_regs_t *hw, void (*quirkproc)(ide_drive_t *),
ide_hwif_t **hwifp)
{
- int index, retry = 1;
+ int index;
ide_hwif_t *hwif;
u8 idx[4] = { 0xff, 0xff, 0xff, 0xff };

- do {
- hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
- index = hwif->index;
- if (hwif)
- goto found;
- for (index = 0; index < MAX_HWIFS; index++)
- ide_unregister(index, 1, 1);
- } while (retry--);
+ hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
+ if (hwif)
+ goto found;
+ for (index = 0; index < MAX_HWIFS; index++)
+ ide_unregister(index, 1, 1);
return -1;
found:
+ index = hwif->index;
if (hwif->present)
ide_unregister(index, 0, 1);
else if (!hwif->hold)

Please comment.

--
Regards,
Peter Teoh

Subject: Re: ide_register_hw(): buggy code


Hi,

On Monday 03 March 2008, Peter Teoh wrote:
> On Sun, Mar 2, 2008 at 11:19 PM, Adrian Bunk <[email protected]> wrote:
> > The Coverity checker spotted the following bogus change to
> > ide_register_hw() in commit 9e016a719209d95338e314b46c3012cc7feaaeec:
> >
> > <-- snip -->
> >
> > ...
> > + hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
> > + index = hwif->index;
> > + if (hwif)
> > + goto found;
> > for (index = 0; index < MAX_HWIFS; index++)
> > ...
> >
> > <-- snip -->
> >
> > It's impossible to reach the for() loop without Oopsing before.

[ iff free hwif is not found (unlikely case) ]

> > Can you either fix this for 2.6.25 or push your patch that removes
> > ide_register_hw() for 2.6.25?
> >
>
> My question is:
>
> a. why is "retry=1", and then the do while loop always end up the
> loop being one round executed only? Why not just remove the while
> loop entirely?

the whole ide_register_hw() is already gone in IDE tree
(these patches are scheduled for 2.6.26)

> b. not sure if your statement above implied this, but checking for
> hwif!=0 should be before index. ???
>
> c. "index = hwif->index;" should not be there, but after "found".
> Is that correct?

Yes, could you please re-do your patch to contain:

- only 'hwif->index' change
- proper patch description
- Signed-off-by: line

so I could merge it?

Thanks,
Bart

2008-03-04 01:02:01

by Peter Teoh

[permalink] [raw]
Subject: Re: ide_register_hw(): buggy code

On Tue, Mar 4, 2008 at 6:29 AM, Bartlomiej Zolnierkiewicz
<[email protected]> wrote:
>
> Hi,
>
>
> On Monday 03 March 2008, Peter Teoh wrote:
> > On Sun, Mar 2, 2008 at 11:19 PM, Adrian Bunk <[email protected]> wrote:
> > > The Coverity checker spotted the following bogus change to
> > > ide_register_hw() in commit 9e016a719209d95338e314b46c3012cc7feaaeec:
> > >
> > > <-- snip -->
> > >
> > > ...
> > > + hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
> > > + index = hwif->index;
> > > + if (hwif)
> > > + goto found;
> > > for (index = 0; index < MAX_HWIFS; index++)
> > > ...
> > >
> > > <-- snip -->
> > >
> > > It's impossible to reach the for() loop without Oopsing before.
>
> [ iff free hwif is not found (unlikely case) ]
>
>
> > > Can you either fix this for 2.6.25 or push your patch that removes
> > > ide_register_hw() for 2.6.25?
> > >
> >
> > My question is:
> >
> > a. why is "retry=1", and then the do while loop always end up the
> > loop being one round executed only? Why not just remove the while
> > loop entirely?
>
> the whole ide_register_hw() is already gone in IDE tree
> (these patches are scheduled for 2.6.26)
>
>
> > b. not sure if your statement above implied this, but checking for
> > hwif!=0 should be before index. ???
> >
> > c. "index = hwif->index;" should not be there, but after "found".
> > Is that correct?
>
> Yes, could you please re-do your patch to contain:
>
> - only 'hwif->index' change
> - proper patch description
> - Signed-off-by: line
>
> so I could merge it?


Description:

Relocating the index to come after finding the hwif pointer.

Thanks.

--
Regards,
Peter Teoh


Attachments:
(No filename) (1.75 kB)
relocating_deriving_index.patch (614.00 B)
Download all attachments
Subject: Re: ide_register_hw(): buggy code

On Tuesday 04 March 2008, Peter Teoh wrote:
> On Tue, Mar 4, 2008 at 6:29 AM, Bartlomiej Zolnierkiewicz
> <[email protected]> wrote:
> >
> > Hi,
> >
> >
> > On Monday 03 March 2008, Peter Teoh wrote:
> > > On Sun, Mar 2, 2008 at 11:19 PM, Adrian Bunk <[email protected]> wrote:
> > > > The Coverity checker spotted the following bogus change to
> > > > ide_register_hw() in commit 9e016a719209d95338e314b46c3012cc7feaaeec:
> > > >
> > > > <-- snip -->
> > > >
> > > > ...
> > > > + hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
> > > > + index = hwif->index;
> > > > + if (hwif)
> > > > + goto found;
> > > > for (index = 0; index < MAX_HWIFS; index++)
> > > > ...
> > > >
> > > > <-- snip -->
> > > >
> > > > It's impossible to reach the for() loop without Oopsing before.
> >
> > [ iff free hwif is not found (unlikely case) ]
> >
> >
> > > > Can you either fix this for 2.6.25 or push your patch that removes
> > > > ide_register_hw() for 2.6.25?
> > > >
> > >
> > > My question is:
> > >
> > > a. why is "retry=1", and then the do while loop always end up the
> > > loop being one round executed only? Why not just remove the while
> > > loop entirely?
> >
> > the whole ide_register_hw() is already gone in IDE tree
> > (these patches are scheduled for 2.6.26)
> >
> >
> > > b. not sure if your statement above implied this, but checking for
> > > hwif!=0 should be before index. ???
> > >
> > > c. "index = hwif->index;" should not be there, but after "found".
> > > Is that correct?
> >
> > Yes, could you please re-do your patch to contain:
> >
> > - only 'hwif->index' change
> > - proper patch description
> > - Signed-off-by: line
> >
> > so I could merge it?
>
>
> Description:
>
> Relocating the index to come after finding the hwif pointer.

applied, thanks