Coverity: nxp_spifi_write_reg(): Integer handling issues

Coverity: nxp_spifi_write_reg(): Integer handling issues

[coverity-bot]

Hello!

This is an experimental automated report about issues detected by Coverity
from a scan of next-20200410 as part of the linux-next weekly scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan

You're getting this email because you were associated with the identified
lines of code (noted below) that were touched by recent commits:

f617b9587c16 ("mtd: spi-nor: add driver for NXP SPI Flash Interface (SPIFI)")

Coverity reported the following:

*** CID 1324209:  Integer handling issues  (SIGN_EXTENSION)
/drivers/mtd/spi-nor/controllers/nxp-spifi.c: 162 in nxp_spifi_write_reg()
156     	ret = nxp_spifi_set_memory_mode_off(spifi);
157     	if (ret)
158     		return ret;
159
160     	cmd = SPIFI_CMD_DOUT |
161     	      SPIFI_CMD_DATALEN(len) |
vvv     CID 1324209:  Integer handling issues  (SIGN_EXTENSION)
vvv     Suspicious implicit sign extension: "opcode" with type "u8" (8 bits, unsigned) is promoted in "opcode << 24" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned).  If "opcode << 24" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
162     	      SPIFI_CMD_OPCODE(opcode) |
163     	      SPIFI_CMD_FIELDFORM_ALL_SERIAL |
164     	      SPIFI_CMD_FRAMEFORM_OPCODE_ONLY;
165     	writel(cmd, spifi->io_base + SPIFI_CMD);
166
167     	while (len--)

If this is a false positive, please let us know so we can mark it as
such, or teach the Coverity rules to be smarter. If not, please make
sure fixes get into linux-next. :) For patches fixing this, please
include these lines (but double-check the "Fixes" first):

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1324209 ("Integer handling issues")
Fixes: f617b9587c16 ("mtd: spi-nor: add driver for NXP SPI Flash Interface (SPIFI)")

Human edit: this issue is also repeated again at
	drivers/mtd/spi-nor/controllers/nxp-spifi.c: 205
and
	drivers/mtd/spi-nor/controllers/nxp-spifi.c: 138

Thanks for your attention!

-- 
Coverity-bot

Re: Coverity: nxp_spifi_write_reg(): Integer handling issues

[Kees Cook]

On Fri, Apr 10, 2020 at 01:01:46PM -0700, coverity-bot wrote:
> Hello!
> 
> This is an experimental automated report about issues detected by Coverity
> from a scan of next-20200410 as part of the linux-next weekly scan project:
> https://scan.coverity.com/projects/linux-next-weekly-scan
> 
> You're getting this email because you were associated with the identified
> lines of code (noted below) that were touched by recent commits:
> 
> f617b9587c16 ("mtd: spi-nor: add driver for NXP SPI Flash Interface (SPIFI)")

This commit is from 2015. I see now that this might have gotten
re-identified due to a file naming?

a0900d0195d2 ("mtd: spi-nor: Prepare core / manufacturer code split")

-Kees

> 
> Coverity reported the following:
> 
> *** CID 1324209:  Integer handling issues  (SIGN_EXTENSION)
> /drivers/mtd/spi-nor/controllers/nxp-spifi.c: 162 in nxp_spifi_write_reg()
> 156     	ret = nxp_spifi_set_memory_mode_off(spifi);
> 157     	if (ret)
> 158     		return ret;
> 159
> 160     	cmd = SPIFI_CMD_DOUT |
> 161     	      SPIFI_CMD_DATALEN(len) |
> vvv     CID 1324209:  Integer handling issues  (SIGN_EXTENSION)
> vvv     Suspicious implicit sign extension: "opcode" with type "u8" (8 bits, unsigned) is promoted in "opcode << 24" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned).  If "opcode << 24" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
> 162     	      SPIFI_CMD_OPCODE(opcode) |
> 163     	      SPIFI_CMD_FIELDFORM_ALL_SERIAL |
> 164     	      SPIFI_CMD_FRAMEFORM_OPCODE_ONLY;
> 165     	writel(cmd, spifi->io_base + SPIFI_CMD);
> 166
> 167     	while (len--)
> 
> If this is a false positive, please let us know so we can mark it as
> such, or teach the Coverity rules to be smarter. If not, please make
> sure fixes get into linux-next. :) For patches fixing this, please
> include these lines (but double-check the "Fixes" first):
> 
> Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
> Addresses-Coverity-ID: 1324209 ("Integer handling issues")
> Fixes: f617b9587c16 ("mtd: spi-nor: add driver for NXP SPI Flash Interface (SPIFI)")
> 
> Human edit: this issue is also repeated again at
> 	drivers/mtd/spi-nor/controllers/nxp-spifi.c: 205
> and
> 	drivers/mtd/spi-nor/controllers/nxp-spifi.c: 138
> 
> Thanks for your attention!
> 
> -- 
> Coverity-bot

-- 
Kees Cook