2013-07-12 08:26:37

by Hayes Wang

[permalink] [raw]
Subject: [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression

config: make ARCH=avr32 allyesconfig
drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit':
drivers/net/usb/r8152.c:956: warning: integer overflow in expression

955 memset(tx_desc, 0, sizeof(*tx_desc));
> 956 tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS);
957 tp->tx_skb = skb;

Signed-off-by: Hayes Wang <[email protected]>
Spotted-by: kbuild test robot <[email protected]>
---
drivers/net/usb/r8152.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d02bac8..ee13f9e 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -934,7 +934,8 @@ static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
struct r8152 *tp = netdev_priv(netdev);
struct net_device_stats *stats = rtl8152_get_stats(netdev);
struct tx_desc *tx_desc;
- int len, res;
+ unsigned int len;
+ int res;

netif_stop_queue(netdev);
len = skb->len;
--
1.8.3.1


2013-07-12 08:26:36

by Hayes Wang

[permalink] [raw]
Subject: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32

>> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
>> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
>> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident>

Signed-off-by: Hayes Wang <[email protected]>
Spotted-by: kbuild test robot <[email protected]>
---
drivers/net/usb/r815x.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
index 6516737..8523922 100644
--- a/drivers/net/usb/r815x.c
+++ b/drivers/net/usb/r815x.c
@@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index)
{
int data, ret;
u8 shift = index & 2;
+ __le32 ocp_data;

index &= ~3;

ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
- index, MCU_TYPE_PLA, &data, sizeof(data), 500);
+ index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
+ 500);
if (ret < 0)
return ret;

- data = __le32_to_cpu(data);
+ data = __le32_to_cpu(ocp_data);
data >>= (shift * 8);
data &= 0xffff;

@@ -44,7 +46,8 @@ static int pla_read_word(struct usb_device *udev, u16 index)

static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
{
- u32 tmp, mask = 0xffff;
+ __le32 ocp_data;
+ u32 mask = 0xffff;
u16 byen = BYTE_EN_WORD;
u8 shift = index & 2;
int ret;
@@ -60,18 +63,18 @@ static int pla_write_word(struct usb_device *udev, u16 index, u32 data)

ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
- index, MCU_TYPE_PLA, &tmp, sizeof(tmp), 500);
+ index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
+ 500);
if (ret < 0)
return ret;

- tmp = __le32_to_cpu(tmp) & ~mask;
- tmp |= data;
- tmp = __cpu_to_le32(tmp);
+ data |= __le32_to_cpu(ocp_data) & ~mask;
+ ocp_data = __cpu_to_le32(data);

ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
- index, MCU_TYPE_PLA | byen, &tmp,
- sizeof(tmp), 500);
+ index, MCU_TYPE_PLA | byen, &ocp_data,
+ sizeof(ocp_data), 500);

return ret;
}
--
1.8.3.1

2013-07-12 23:14:06

by David Miller

[permalink] [raw]
Subject: Re: [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression

From: Hayes Wang <[email protected]>
Date: Fri, 12 Jul 2013 16:26:15 +0800

> config: make ARCH=avr32 allyesconfig
> drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit':
> drivers/net/usb/r8152.c:956: warning: integer overflow in expression
>
> 955 memset(tx_desc, 0, sizeof(*tx_desc));
> > 956 tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS);
> 957 tp->tx_skb = skb;
>
> Signed-off-by: Hayes Wang <[email protected]>
> Spotted-by: kbuild test robot <[email protected]>

Applied.

2013-07-12 23:14:10

by David Miller

[permalink] [raw]
Subject: Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32

From: Hayes Wang <[email protected]>
Date: Fri, 12 Jul 2013 16:26:16 +0800

>>> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
>>> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
>>> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
> drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
> drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident>
>
> Signed-off-by: Hayes Wang <[email protected]>
> Spotted-by: kbuild test robot <[email protected]>

Applied.

2013-07-15 18:45:50

by Ben Hutchings

[permalink] [raw]
Subject: Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32

On Fri, 2013-07-12 at 16:26 +0800, Hayes Wang wrote:
> >> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
> >> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
> >> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
> drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
> drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident>
>
> Signed-off-by: Hayes Wang <[email protected]>
> Spotted-by: kbuild test robot <[email protected]>
> ---
> drivers/net/usb/r815x.c | 21 ++++++++++++---------
> 1 file changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
> index 6516737..8523922 100644
> --- a/drivers/net/usb/r815x.c
> +++ b/drivers/net/usb/r815x.c
> @@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index)
> {
> int data, ret;
> u8 shift = index & 2;
> + __le32 ocp_data;
>
> index &= ~3;
>
> ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
> RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
> - index, MCU_TYPE_PLA, &data, sizeof(data), 500);
> + index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
> + 500);
[...]

There seems to be another bug here: USB buffers must be DMA-able,
therefore cannot be placed on the stack.

Ben.

--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.