* [PATCH] net/sun3_82586: Kill array subscript above array bounds warning
@ 2013-07-17 12:25 Geert Uytterhoeven
2013-07-18 1:22 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Geert Uytterhoeven @ 2013-07-17 12:25 UTC (permalink / raw)
To: David S. Miller, Sam Creasey
Cc: netdev, linux-m68k, linux-kernel, Geert Uytterhoeven
drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout':
drivers/net/ethernet/i825xx/sun3_82586.c:993:89: warning: array subscript is above array bounds [-Warray-bounds]
Using the default NUM_XMIT_BUFFS = 1, there's only one transmit buffer.
Hence accessing the second buffer is an out-of-bounds access.
Print the command status of the first NOP buffer instead.
Fortunately this actually worked fine, as the layout of transmit and NOP
buffers is sufficiently similar.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
---
- Untested due to lack of hardware
- Note that the driver never compiled with the non-default NUM_XMIT_BUFFS > 1
drivers/net/ethernet/i825xx/sun3_82586.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c
index 353f57f6..d283d2e 100644
--- a/drivers/net/ethernet/i825xx/sun3_82586.c
+++ b/drivers/net/ethernet/i825xx/sun3_82586.c
@@ -990,7 +990,14 @@ static void sun3_82586_timeout(struct net_device *dev)
{
#ifdef DEBUG
printk("%s: xmitter timed out, try to restart! stat: %02x\n",dev->name,p->scb->cus);
- printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status));
+ printk("%s: command-stats: %04x %04x\n", dev->name,
+ swab16(p->xmit_cmds[0]->cmd_status),
+#if (NUM_XMIT_BUFFS > 1)
+ swab16(p->xmit_cmds[1]->cmd_status)
+#else
+ swab16(p->nop_cmds[0]->cmd_status)
+#endif
+ );
printk("%s: check, whether you set the right interrupt number!\n",dev->name);
#endif
sun3_82586_close(dev);
--
1.7.9.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] net/sun3_82586: Kill array subscript above array bounds warning
2013-07-17 12:25 [PATCH] net/sun3_82586: Kill array subscript above array bounds warning Geert Uytterhoeven
@ 2013-07-18 1:22 ` David Miller
2013-07-18 7:04 ` Geert Uytterhoeven
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2013-07-18 1:22 UTC (permalink / raw)
To: geert; +Cc: sammy, netdev, linux-m68k, linux-kernel
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Wed, 17 Jul 2013 14:25:05 +0200
> drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout':
> drivers/net/ethernet/i825xx/sun3_82586.c:993:89: warning: array subscript is above array bounds [-Warray-bounds]
>
> Using the default NUM_XMIT_BUFFS = 1, there's only one transmit buffer.
> Hence accessing the second buffer is an out-of-bounds access.
> Print the command status of the first NOP buffer instead.
>
> Fortunately this actually worked fine, as the layout of transmit and NOP
> buffers is sufficiently similar.
>
> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Three more CPP directives in a DEBUG ifdef'd piece of code, yuck.
I'd say just kill this whole DEBUG section entirely. If people
want this driver to print this debugging, do it properly with
netif_err() or similar.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] net/sun3_82586: Kill array subscript above array bounds warning
2013-07-18 1:22 ` David Miller
@ 2013-07-18 7:04 ` Geert Uytterhoeven
0 siblings, 0 replies; 3+ messages in thread
From: Geert Uytterhoeven @ 2013-07-18 7:04 UTC (permalink / raw)
To: David Miller; +Cc: Sam Creasey, netdev, Linux/m68k, linux-kernel
On Thu, Jul 18, 2013 at 3:22 AM, David Miller <davem@davemloft.net> wrote:
>> drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout':
>> drivers/net/ethernet/i825xx/sun3_82586.c:993:89: warning: array subscript is above array bounds [-Warray-bounds]
>>
>> Using the default NUM_XMIT_BUFFS = 1, there's only one transmit buffer.
>> Hence accessing the second buffer is an out-of-bounds access.
>> Print the command status of the first NOP buffer instead.
>>
>> Fortunately this actually worked fine, as the layout of transmit and NOP
>> buffers is sufficiently similar.
>>
>> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
>
> Three more CPP directives in a DEBUG ifdef'd piece of code, yuck.
>
> I'd say just kill this whole DEBUG section entirely. If people
> want this driver to print this debugging, do it properly with
> netif_err() or similar.
Yeah, this driver could use some major cleanup. I had to protect my eyes while
fixing the compiler warning.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-07-18 7:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-07-17 12:25 [PATCH] net/sun3_82586: Kill array subscript above array bounds warning Geert Uytterhoeven
2013-07-18 1:22 ` David Miller
2013-07-18 7:04 ` Geert Uytterhoeven
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.