[PATCH net 1/2] usb/net/r8152: fix integer overflow in expression

[PATCH net 1/2] usb/net/r8152: fix integer overflow in expression

[Hayes Wang]

config: make ARCH=avr32 allyesconfig
drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit':
drivers/net/usb/r8152.c:956: warning: integer overflow in expression

   955	memset(tx_desc, 0, sizeof(*tx_desc));
 > 956	tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS);
   957	tp->tx_skb = skb;

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Spotted-by: kbuild test robot <fengguang.wu@intel.com>
---
 drivers/net/usb/r8152.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d02bac8..ee13f9e 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -934,7 +934,8 @@ static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
 	struct r8152 *tp = netdev_priv(netdev);
 	struct net_device_stats *stats = rtl8152_get_stats(netdev);
 	struct tx_desc *tx_desc;
-	int len, res;
+	unsigned int len;
+	int res;
 
 	netif_stop_queue(netdev);
 	len = skb->len;
-- 
1.8.3.1

[PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32

[Hayes Wang]

>> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
>> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
>> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
   drivers/net/usb/r815x.c:69:13:    expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
   drivers/net/usb/r815x.c:69:13:    got restricted __le32 [usertype] <noident>

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Spotted-by: kbuild test robot <fengguang.wu@intel.com>
---
 drivers/net/usb/r815x.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
index 6516737..8523922 100644
--- a/drivers/net/usb/r815x.c
+++ b/drivers/net/usb/r815x.c
@@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index)
 {
 	int data, ret;
 	u8 shift = index & 2;
+	__le32 ocp_data;
 
 	index &= ~3;
 
 	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 			      RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-			      index, MCU_TYPE_PLA, &data, sizeof(data), 500);
+			      index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
+			      500);
 	if (ret < 0)
 		return ret;
 
-	data = __le32_to_cpu(data);
+	data = __le32_to_cpu(ocp_data);
 	data >>= (shift * 8);
 	data &= 0xffff;
 
@@ -44,7 +46,8 @@ static int pla_read_word(struct usb_device *udev, u16 index)
 
 static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
 {
-	u32 tmp, mask = 0xffff;
+	__le32 ocp_data;
+	u32 mask = 0xffff;
 	u16 byen = BYTE_EN_WORD;
 	u8 shift = index & 2;
 	int ret;
@@ -60,18 +63,18 @@ static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
 
 	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 			      RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-			      index, MCU_TYPE_PLA, &tmp, sizeof(tmp), 500);
+			      index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
+			      500);
 	if (ret < 0)
 		return ret;
 
-	tmp = __le32_to_cpu(tmp) & ~mask;
-	tmp |= data;
-	tmp = __cpu_to_le32(tmp);
+	data |= __le32_to_cpu(ocp_data) & ~mask;
+	ocp_data = __cpu_to_le32(data);
 
 	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 			      RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
-			      index, MCU_TYPE_PLA | byen, &tmp,
-			      sizeof(tmp), 500);
+			      index, MCU_TYPE_PLA | byen, &ocp_data,
+			      sizeof(ocp_data), 500);
 
 	return ret;
 }
-- 
1.8.3.1

Re: [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression

[David Miller]

From: Hayes Wang <hayeswang@realtek.com>
Date: Fri, 12 Jul 2013 16:26:15 +0800

> config: make ARCH=avr32 allyesconfig
> drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit':
> drivers/net/usb/r8152.c:956: warning: integer overflow in expression
> 
>    955	memset(tx_desc, 0, sizeof(*tx_desc));
>  > 956	tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS);
>    957	tp->tx_skb = skb;
> 
> Signed-off-by: Hayes Wang <hayeswang@realtek.com>
> Spotted-by: kbuild test robot <fengguang.wu@intel.com>

Applied.

Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32

[David Miller]

From: Hayes Wang <hayeswang@realtek.com>
Date: Fri, 12 Jul 2013 16:26:16 +0800

>>> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
>>> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
>>> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
>    drivers/net/usb/r815x.c:69:13:    expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
>    drivers/net/usb/r815x.c:69:13:    got restricted __le32 [usertype] <noident>
> 
> Signed-off-by: Hayes Wang <hayeswang@realtek.com>
> Spotted-by: kbuild test robot <fengguang.wu@intel.com>

Applied.

Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32

[Ben Hutchings]

On Fri, 2013-07-12 at 16:26 +0800, Hayes Wang wrote:
> >> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
> >> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
> >> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
>    drivers/net/usb/r815x.c:69:13:    expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
>    drivers/net/usb/r815x.c:69:13:    got restricted __le32 [usertype] <noident>
> 
> Signed-off-by: Hayes Wang <hayeswang@realtek.com>
> Spotted-by: kbuild test robot <fengguang.wu@intel.com>
> ---
>  drivers/net/usb/r815x.c | 21 ++++++++++++---------
>  1 file changed, 12 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
> index 6516737..8523922 100644
> --- a/drivers/net/usb/r815x.c
> +++ b/drivers/net/usb/r815x.c
> @@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index)
>  {
>  	int data, ret;
>  	u8 shift = index & 2;
> +	__le32 ocp_data;
>  
>  	index &= ~3;
>  
>  	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
>  			      RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
> -			      index, MCU_TYPE_PLA, &data, sizeof(data), 500);
> +			      index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
> +			      500);
[...]

There seems to be another bug here: USB buffers must be DMA-able,
therefore cannot be placed on the stack.

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.