Coverity complains about
"Improper use of negative value
The negative value may be unexpected by later operations, causing
incorrect computations.
In tpm_stm_i2c_send: Negative value can be returned from function is not
being checked before being used improperly (CWE-394)"
The 'get_burstcount' function can in some circumstances 'return -EBUSY' which
in tpm_stm_i2c_send is stored in an 'u32 burstcnt'
thus converting the signed value into an unsigned value, resulting
in 'burstcnt' being huge.
Changing the type to u32 only does not solve the problem as the signed
value is converted to an unsigned in I2C_WRITE_DATA, resulting in the
same effect.
Thus
-> Change type of burstcnt to u32 (the return type of get_burstcount)
-> Add a check for the return value of 'get_burstcount' and propagate a
potential error.
This makes also sense in the 'I2C_READ_DATA' case, where the there is no
signed/unsigned conversion.
CID: 986658
Cc: [email protected]
Signed-off-by: Peter Huewe <[email protected]>
---
drivers/char/tpm/tpm_i2c_stm_st33.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
index a0d6ceb5..cf68403 100644
--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
+++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
@@ -410,6 +410,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
&chip->vendor.read_queue)
== 0) {
burstcnt = get_burstcount(chip);
+ if (burstcnt < 0)
+ return burstcnt;
len = min_t(int, burstcnt, count - size);
I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
size += len;
@@ -451,7 +453,8 @@ static irqreturn_t tpm_ioserirq_handler(int irq, void *dev_id)
static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
size_t len)
{
- u32 status, burstcnt = 0, i, size;
+ u32 status, i, size;
+ int burstcnt = 0;
int ret;
u8 data;
struct i2c_client *client;
@@ -482,6 +485,8 @@ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
for (i = 0; i < len - 1;) {
burstcnt = get_burstcount(chip);
+ if (burstcnt < 0)
+ return burstcnt;
size = min_t(int, len - i - 1, burstcnt);
ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
if (ret < 0)
--
1.7.8.6
On Wed, Oct 30, 2013 at 12:54:20AM +0100, Peter Huewe wrote:
> Coverity complains about
> "Improper use of negative value
> The negative value may be unexpected by later operations, causing
> incorrect computations.
> In tpm_stm_i2c_send: Negative value can be returned from function is not
> being checked before being used improperly (CWE-394)"
>
> The 'get_burstcount' function can in some circumstances 'return -EBUSY' which
> in tpm_stm_i2c_send is stored in an 'u32 burstcnt'
> thus converting the signed value into an unsigned value, resulting
> in 'burstcnt' being huge.
> Changing the type to u32 only does not solve the problem as the signed
> value is converted to an unsigned in I2C_WRITE_DATA, resulting in the
> same effect.
>
> Thus
> -> Change type of burstcnt to u32 (the return type of get_burstcount)
> -> Add a check for the return value of 'get_burstcount' and propagate a
> potential error.
>
> This makes also sense in the 'I2C_READ_DATA' case, where the there is no
> signed/unsigned conversion.
>
> CID: 986658
What is this field for?
thanks,
greg k-h
Hi Greg,
> >
> > CID: 986658
> What is this field for?
That's the scan id in the coverity database.
If you think that's just noise I can leave it out.
Thanks,
Peter
On Wed, Oct 30, 2013 at 01:42:11AM +0100, Peter H?we wrote:
> Hi Greg,
> > >
> > > CID: 986658
> > What is this field for?
>
> That's the scan id in the coverity database.
> If you think that's just noise I can leave it out.
It's noise as not everyone can see it or make anything out of it, so
please don't include it.
thanks,
greg k-h
Hi Greg,
> It [the CID] is noise as not everyone can see it or make anything out of it,
> so please don't include it.
I'll remove it from my tree before sending out the pull request to James.
Thanks for your opinion.
Peter