* [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression
@ 2013-07-12 8:26 Hayes Wang
2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang
2013-07-12 23:13 ` [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression David Miller
0 siblings, 2 replies; 5+ messages in thread
From: Hayes Wang @ 2013-07-12 8:26 UTC (permalink / raw)
To: gregkh; +Cc: netdev, linux-kernel, linux-usb, Hayes Wang
config: make ARCH=avr32 allyesconfig
drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit':
drivers/net/usb/r8152.c:956: warning: integer overflow in expression
955 memset(tx_desc, 0, sizeof(*tx_desc));
> 956 tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS);
957 tp->tx_skb = skb;
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Spotted-by: kbuild test robot <fengguang.wu@intel.com>
---
drivers/net/usb/r8152.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d02bac8..ee13f9e 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -934,7 +934,8 @@ static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
struct r8152 *tp = netdev_priv(netdev);
struct net_device_stats *stats = rtl8152_get_stats(netdev);
struct tx_desc *tx_desc;
- int len, res;
+ unsigned int len;
+ int res;
netif_stop_queue(netdev);
len = skb->len;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32
2013-07-12 8:26 [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression Hayes Wang
@ 2013-07-12 8:26 ` Hayes Wang
2013-07-12 23:14 ` David Miller
2013-07-15 18:45 ` Ben Hutchings
2013-07-12 23:13 ` [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression David Miller
1 sibling, 2 replies; 5+ messages in thread
From: Hayes Wang @ 2013-07-12 8:26 UTC (permalink / raw)
To: gregkh; +Cc: netdev, linux-kernel, linux-usb, Hayes Wang
>> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
>> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
>> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident>
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Spotted-by: kbuild test robot <fengguang.wu@intel.com>
---
drivers/net/usb/r815x.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
index 6516737..8523922 100644
--- a/drivers/net/usb/r815x.c
+++ b/drivers/net/usb/r815x.c
@@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index)
{
int data, ret;
u8 shift = index & 2;
+ __le32 ocp_data;
index &= ~3;
ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
- index, MCU_TYPE_PLA, &data, sizeof(data), 500);
+ index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
+ 500);
if (ret < 0)
return ret;
- data = __le32_to_cpu(data);
+ data = __le32_to_cpu(ocp_data);
data >>= (shift * 8);
data &= 0xffff;
@@ -44,7 +46,8 @@ static int pla_read_word(struct usb_device *udev, u16 index)
static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
{
- u32 tmp, mask = 0xffff;
+ __le32 ocp_data;
+ u32 mask = 0xffff;
u16 byen = BYTE_EN_WORD;
u8 shift = index & 2;
int ret;
@@ -60,18 +63,18 @@ static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
- index, MCU_TYPE_PLA, &tmp, sizeof(tmp), 500);
+ index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
+ 500);
if (ret < 0)
return ret;
- tmp = __le32_to_cpu(tmp) & ~mask;
- tmp |= data;
- tmp = __cpu_to_le32(tmp);
+ data |= __le32_to_cpu(ocp_data) & ~mask;
+ ocp_data = __cpu_to_le32(data);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
- index, MCU_TYPE_PLA | byen, &tmp,
- sizeof(tmp), 500);
+ index, MCU_TYPE_PLA | byen, &ocp_data,
+ sizeof(ocp_data), 500);
return ret;
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression
2013-07-12 8:26 [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression Hayes Wang
2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang
@ 2013-07-12 23:13 ` David Miller
1 sibling, 0 replies; 5+ messages in thread
From: David Miller @ 2013-07-12 23:13 UTC (permalink / raw)
To: hayeswang; +Cc: gregkh, netdev, linux-kernel, linux-usb
From: Hayes Wang <hayeswang@realtek.com>
Date: Fri, 12 Jul 2013 16:26:15 +0800
> config: make ARCH=avr32 allyesconfig
> drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit':
> drivers/net/usb/r8152.c:956: warning: integer overflow in expression
>
> 955 memset(tx_desc, 0, sizeof(*tx_desc));
> > 956 tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS);
> 957 tp->tx_skb = skb;
>
> Signed-off-by: Hayes Wang <hayeswang@realtek.com>
> Spotted-by: kbuild test robot <fengguang.wu@intel.com>
Applied.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32
2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang
@ 2013-07-12 23:14 ` David Miller
2013-07-15 18:45 ` Ben Hutchings
1 sibling, 0 replies; 5+ messages in thread
From: David Miller @ 2013-07-12 23:14 UTC (permalink / raw)
To: hayeswang; +Cc: gregkh, netdev, linux-kernel, linux-usb
From: Hayes Wang <hayeswang@realtek.com>
Date: Fri, 12 Jul 2013 16:26:16 +0800
>>> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
>>> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
>>> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
> drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
> drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident>
>
> Signed-off-by: Hayes Wang <hayeswang@realtek.com>
> Spotted-by: kbuild test robot <fengguang.wu@intel.com>
Applied.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32
2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang
2013-07-12 23:14 ` David Miller
@ 2013-07-15 18:45 ` Ben Hutchings
1 sibling, 0 replies; 5+ messages in thread
From: Ben Hutchings @ 2013-07-15 18:45 UTC (permalink / raw)
To: Hayes Wang; +Cc: gregkh, netdev, linux-kernel, linux-usb
On Fri, 2013-07-12 at 16:26 +0800, Hayes Wang wrote:
> >> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32
> >> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32
> >> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types)
> drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp
> drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident>
>
> Signed-off-by: Hayes Wang <hayeswang@realtek.com>
> Spotted-by: kbuild test robot <fengguang.wu@intel.com>
> ---
> drivers/net/usb/r815x.c | 21 ++++++++++++---------
> 1 file changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
> index 6516737..8523922 100644
> --- a/drivers/net/usb/r815x.c
> +++ b/drivers/net/usb/r815x.c
> @@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index)
> {
> int data, ret;
> u8 shift = index & 2;
> + __le32 ocp_data;
>
> index &= ~3;
>
> ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
> RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
> - index, MCU_TYPE_PLA, &data, sizeof(data), 500);
> + index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
> + 500);
[...]
There seems to be another bug here: USB buffers must be DMA-able,
therefore cannot be placed on the stack.
Ben.
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-07-15 18:45 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-07-12 8:26 [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression Hayes Wang
2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang
2013-07-12 23:14 ` David Miller
2013-07-15 18:45 ` Ben Hutchings
2013-07-12 23:13 ` [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).