* [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() @ 2012-01-17 7:30 Dan Carpenter 2012-01-18 17:06 ` walter harms 0 siblings, 1 reply; 6+ messages in thread From: Dan Carpenter @ 2012-01-17 7:30 UTC (permalink / raw) To: Mauro Carvalho Chehab Cc: Igor M. Liplianin, linux-media, linux-kernel, kernel-janitors This is a static checker patch and I don't have the hardware to test this, so please review it carefully. The dvbs2_snr_tab[] array has 80 elements so when we cap it at 80, that's off by one. I would have assumed that the test was wrong but in the lines right before we have the same test but use "snr_reading - 1" as the array offset. I've done the same thing here. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> diff --git a/drivers/media/dvb/frontends/ds3000.c b/drivers/media/dvb/frontends/ds3000.c index af65d01..3f5ae0a 100644 --- a/drivers/media/dvb/frontends/ds3000.c +++ b/drivers/media/dvb/frontends/ds3000.c @@ -681,7 +681,7 @@ static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr) snr_reading = dvbs2_noise_reading / tmp; if (snr_reading > 80) snr_reading = 80; - *snr = -(dvbs2_snr_tab[snr_reading] / 1000); + *snr = -(dvbs2_snr_tab[snr_reading - 1] / 1000); } dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__, snr_reading, *snr); ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() 2012-01-17 7:30 [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() Dan Carpenter @ 2012-01-18 17:06 ` walter harms 2012-01-19 9:33 ` Dan Carpenter 0 siblings, 1 reply; 6+ messages in thread From: walter harms @ 2012-01-18 17:06 UTC (permalink / raw) To: Dan Carpenter Cc: Mauro Carvalho Chehab, Igor M. Liplianin, linux-media, linux-kernel, kernel-janitors Am 17.01.2012 08:30, schrieb Dan Carpenter: > This is a static checker patch and I don't have the hardware to test > this, so please review it carefully. The dvbs2_snr_tab[] array has 80 > elements so when we cap it at 80, that's off by one. I would have > assumed that the test was wrong but in the lines right before we have > the same test but use "snr_reading - 1" as the array offset. I've done > the same thing here. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > diff --git a/drivers/media/dvb/frontends/ds3000.c b/drivers/media/dvb/frontends/ds3000.c > index af65d01..3f5ae0a 100644 > --- a/drivers/media/dvb/frontends/ds3000.c > +++ b/drivers/media/dvb/frontends/ds3000.c > @@ -681,7 +681,7 @@ static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr) > snr_reading = dvbs2_noise_reading / tmp; > if (snr_reading > 80) > snr_reading = 80; > - *snr = -(dvbs2_snr_tab[snr_reading] / 1000); > + *snr = -(dvbs2_snr_tab[snr_reading - 1] / 1000); > } > dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__, > snr_reading, *snr); hi dan, perhaps it is more useful to do it in the check above ? thinking about that why not replace the number (80) with ARRAY_SIZE() ? re, wh ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() 2012-01-18 17:06 ` walter harms @ 2012-01-19 9:33 ` Dan Carpenter 2012-01-19 10:26 ` walter harms 0 siblings, 1 reply; 6+ messages in thread From: Dan Carpenter @ 2012-01-19 9:33 UTC (permalink / raw) To: walter harms Cc: Mauro Carvalho Chehab, Igor M. Liplianin, linux-media, linux-kernel, kernel-janitors [-- Attachment #1: Type: text/plain, Size: 1634 bytes --] On Wed, Jan 18, 2012 at 06:06:46PM +0100, walter harms wrote: > > > Am 17.01.2012 08:30, schrieb Dan Carpenter: > > This is a static checker patch and I don't have the hardware to test > > this, so please review it carefully. The dvbs2_snr_tab[] array has 80 > > elements so when we cap it at 80, that's off by one. I would have > > assumed that the test was wrong but in the lines right before we have > > the same test but use "snr_reading - 1" as the array offset. I've done > > the same thing here. > > > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > > > diff --git a/drivers/media/dvb/frontends/ds3000.c b/drivers/media/dvb/frontends/ds3000.c > > index af65d01..3f5ae0a 100644 > > --- a/drivers/media/dvb/frontends/ds3000.c > > +++ b/drivers/media/dvb/frontends/ds3000.c > > @@ -681,7 +681,7 @@ static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr) > > snr_reading = dvbs2_noise_reading / tmp; > > if (snr_reading > 80) > > snr_reading = 80; > > - *snr = -(dvbs2_snr_tab[snr_reading] / 1000); > > + *snr = -(dvbs2_snr_tab[snr_reading - 1] / 1000); > > } > > dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__, > > snr_reading, *snr); > > hi dan, > > perhaps it is more useful to do it in the check above ? It looks like the check is correct but we need to shift all the values by one. Again, I don't have this hardware, I'm just going by the context. > thinking about that why not replace the number (80) with ARRAY_SIZE() ? That would be a cleanup, yes but it could go in a separate patch. regards, dan carpenter [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 836 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() 2012-01-19 9:33 ` Dan Carpenter @ 2012-01-19 10:26 ` walter harms 2012-01-19 12:22 ` Dan Carpenter 0 siblings, 1 reply; 6+ messages in thread From: walter harms @ 2012-01-19 10:26 UTC (permalink / raw) To: Dan Carpenter Cc: Mauro Carvalho Chehab, Igor M. Liplianin, linux-media, linux-kernel, kernel-janitors Am 19.01.2012 10:33, schrieb Dan Carpenter: > On Wed, Jan 18, 2012 at 06:06:46PM +0100, walter harms wrote: >> >> >> Am 17.01.2012 08:30, schrieb Dan Carpenter: >>> This is a static checker patch and I don't have the hardware to test >>> this, so please review it carefully. The dvbs2_snr_tab[] array has 80 >>> elements so when we cap it at 80, that's off by one. I would have >>> assumed that the test was wrong but in the lines right before we have >>> the same test but use "snr_reading - 1" as the array offset. I've done >>> the same thing here. >>> >>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >>> >>> diff --git a/drivers/media/dvb/frontends/ds3000.c b/drivers/media/dvb/frontends/ds3000.c >>> index af65d01..3f5ae0a 100644 >>> --- a/drivers/media/dvb/frontends/ds3000.c >>> +++ b/drivers/media/dvb/frontends/ds3000.c >>> @@ -681,7 +681,7 @@ static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr) >>> snr_reading = dvbs2_noise_reading / tmp; >>> if (snr_reading > 80) >>> snr_reading = 80; >>> - *snr = -(dvbs2_snr_tab[snr_reading] / 1000); >>> + *snr = -(dvbs2_snr_tab[snr_reading - 1] / 1000); >>> } >>> dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__, >>> snr_reading, *snr); >> >> hi dan, >> >> perhaps it is more useful to do it in the check above ? > > It looks like the check is correct but we need to shift all the > values by one. Again, I don't have this hardware, I'm just going by > the context. > I do not have the hardware either so this is pure theoretical. Access to the data field depends on the value of dvbs2_noise_reading/tmp even when the data are reasonable like 50/100 snr_reading would become 0 and the index suddenly is -1. just my 2 cents. re, wh >> thinking about that why not replace the number (80) with ARRAY_SIZE() ? > > That would be a cleanup, yes but it could go in a separate patch. > > regards, > dan carpenter > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() 2012-01-19 10:26 ` walter harms @ 2012-01-19 12:22 ` Dan Carpenter 2012-01-21 15:58 ` Dan Carpenter 0 siblings, 1 reply; 6+ messages in thread From: Dan Carpenter @ 2012-01-19 12:22 UTC (permalink / raw) To: walter harms Cc: Mauro Carvalho Chehab, Igor M. Liplianin, linux-media, linux-kernel, kernel-janitors [-- Attachment #1: Type: text/plain, Size: 632 bytes --] On Thu, Jan 19, 2012 at 11:26:41AM +0100, walter harms wrote: > >> perhaps it is more useful to do it in the check above ? > > > > It looks like the check is correct but we need to shift all the > > values by one. Again, I don't have this hardware, I'm just going by > > the context. > > > I do not have the hardware either so this is pure theoretical. > > Access to the data field depends on the value of dvbs2_noise_reading/tmp > even when the data are reasonable like 50/100 snr_reading would become 0 > and the index suddenly is -1. > It's a good point. I will redo the patch. regards, dan carpenter [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 836 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() 2012-01-19 12:22 ` Dan Carpenter @ 2012-01-21 15:58 ` Dan Carpenter 0 siblings, 0 replies; 6+ messages in thread From: Dan Carpenter @ 2012-01-21 15:58 UTC (permalink / raw) To: walter harms Cc: Mauro Carvalho Chehab, Igor M. Liplianin, linux-media, linux-kernel, kernel-janitors [-- Attachment #1: Type: text/plain, Size: 275 bytes --] On Thu, Jan 19, 2012 at 03:22:02PM +0300, Dan Carpenter wrote: > It's a good point. I will redo the patch. Sorry, I've decided to bail on this. The original code is buggy but I don't know what's going on well enough to fix it with any confidence. regards, dan carpenter [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 836 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-01-21 15:57 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-01-17 7:30 [patch 2/2] [media] ds3000: off by one in ds3000_read_snr() Dan Carpenter 2012-01-18 17:06 ` walter harms 2012-01-19 9:33 ` Dan Carpenter 2012-01-19 10:26 ` walter harms 2012-01-19 12:22 ` Dan Carpenter 2012-01-21 15:58 ` Dan Carpenter
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).