Re: [PATCH v3 4/7] watchdog: dw_wdt: Support devices with non-fixed TOP values

[Dan Carpenter <dan.carpenter@oracle.com>]

[-- Attachment #1: Type: text/plain, Size: 4024 bytes --]

Hi Serge,

url:    https://github.com/0day-ci/linux/commits/Serge-Semin/watchdog-dw_wdt-Take-Baikal-T1-DW-WDT-peculiarities-into-account/20200526-234657
base:   https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git for-next
config: i386-randconfig-m021-20200528 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-13) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/watchdog/dw_wdt.c:124 dw_wdt_get_min_timeout() error: buffer overflow 'dw_wdt->timeouts' 16 <= 16 (assuming for loop doesn't break)
drivers/watchdog/dw_wdt.c:147 dw_wdt_get_timeout() error: buffer overflow 'dw_wdt->timeouts' 16 <= 16 (assuming for loop doesn't break)

# https://github.com/0day-ci/linux/commit/2d6c220c0b6cbc1fd04065b904a6a2f0bfe086e7
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout 2d6c220c0b6cbc1fd04065b904a6a2f0bfe086e7
vim +124 drivers/watchdog/dw_wdt.c

2d6c220c0b6cbc Serge Semin 2020-05-26  111  static unsigned int dw_wdt_get_min_timeout(struct dw_wdt *dw_wdt)
c9353ae1c69ba1 Jamie Iles  2011-01-24  112  {
2d6c220c0b6cbc Serge Semin 2020-05-26  113  	int idx;
2d6c220c0b6cbc Serge Semin 2020-05-26  114  
2d6c220c0b6cbc Serge Semin 2020-05-26  115  	/*
2d6c220c0b6cbc Serge Semin 2020-05-26  116  	 * We'll find a timeout greater or equal to one second anyway because
2d6c220c0b6cbc Serge Semin 2020-05-26  117  	 * the driver probe would have failed if there was none.
2d6c220c0b6cbc Serge Semin 2020-05-26  118  	 */
2d6c220c0b6cbc Serge Semin 2020-05-26  119  	for (idx = 0; idx < DW_WDT_NUM_TOPS; ++idx) {
2d6c220c0b6cbc Serge Semin 2020-05-26  120  		if (dw_wdt->timeouts[idx].sec)
2d6c220c0b6cbc Serge Semin 2020-05-26  121  			break;
2d6c220c0b6cbc Serge Semin 2020-05-26  122  	}
c9353ae1c69ba1 Jamie Iles  2011-01-24  123  
2d6c220c0b6cbc Serge Semin 2020-05-26 @124  	return dw_wdt->timeouts[idx].sec;
                                                       ^^^^^^^^^^^^^^^^^^^^^
Read overflow if we don't break out of the loop.

2d6c220c0b6cbc Serge Semin 2020-05-26  125  }
2d6c220c0b6cbc Serge Semin 2020-05-26  126  
2d6c220c0b6cbc Serge Semin 2020-05-26  127  static unsigned int dw_wdt_get_max_timeout_ms(struct dw_wdt *dw_wdt)
2d6c220c0b6cbc Serge Semin 2020-05-26  128  {
2d6c220c0b6cbc Serge Semin 2020-05-26  129  	struct dw_wdt_timeout *timeout = &dw_wdt->timeouts[DW_WDT_NUM_TOPS - 1];
2d6c220c0b6cbc Serge Semin 2020-05-26  130  	u64 msec;
2d6c220c0b6cbc Serge Semin 2020-05-26  131  
2d6c220c0b6cbc Serge Semin 2020-05-26  132  	msec = (u64)timeout->sec * MSEC_PER_SEC + timeout->msec;
2d6c220c0b6cbc Serge Semin 2020-05-26  133  
2d6c220c0b6cbc Serge Semin 2020-05-26  134  	return msec < UINT_MAX ? msec : UINT_MAX;
2d6c220c0b6cbc Serge Semin 2020-05-26  135  }
2d6c220c0b6cbc Serge Semin 2020-05-26  136  
2d6c220c0b6cbc Serge Semin 2020-05-26  137  static unsigned int dw_wdt_get_timeout(struct dw_wdt *dw_wdt)
2d6c220c0b6cbc Serge Semin 2020-05-26  138  {
2d6c220c0b6cbc Serge Semin 2020-05-26  139  	int top_val = readl(dw_wdt->regs + WDOG_TIMEOUT_RANGE_REG_OFFSET) & 0xF;
2d6c220c0b6cbc Serge Semin 2020-05-26  140  	int idx;
2d6c220c0b6cbc Serge Semin 2020-05-26  141  
2d6c220c0b6cbc Serge Semin 2020-05-26  142  	for (idx = 0; idx < DW_WDT_NUM_TOPS; ++idx) {
2d6c220c0b6cbc Serge Semin 2020-05-26  143  		if (dw_wdt->timeouts[idx].top_val == top_val)
2d6c220c0b6cbc Serge Semin 2020-05-26  144  			break;
2d6c220c0b6cbc Serge Semin 2020-05-26  145  	}
2d6c220c0b6cbc Serge Semin 2020-05-26  146  
2d6c220c0b6cbc Serge Semin 2020-05-26 @147  	return dw_wdt->timeouts[idx].sec;
                                                       ^^^^^^^^^^^^^^^^^^^^^

c9353ae1c69ba1 Jamie Iles  2011-01-24  148  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 36057 bytes --]