From: Matthew Wilcox <matthew@wil.cx>
To: Julia Lawall <julia@diku.dk>, linux-scsi@vger.kernel.org
Cc: Roel Kluin <12o3l@tiscali.nl>,
kernel-janitors@vger.kernel.org,
kernelnewbies-bounce@nl.linux.org
Subject: u14-3f incorrect unsigned test
Date: Sat, 19 Apr 2008 08:17:52 -0600 [thread overview]
Message-ID: <20080419141752.GK20637@parisc-linux.org> (raw)
In-Reply-To: <Pine.LNX.4.64.0804182101200.14832@ask.diku.dk>
On Fri, Apr 18, 2008 at 09:08:55PM +0200, Julia Lawall wrote:
> I found 63 occurrences of this problem with the following semantic match
> (http://www.emn.fr/x-info/coccinelle/):
>
> @@ unsigned int i; @@
>
> * i < 0
>
> I looked through all of the results by hand, and they all seem to be
> problems. In many cases, it seems like the variable should not be
> unsigned as it is used to hold the return value of a function that might
> return a negative error code, but I haven't looked into this in detail.
>
> In the output below, the lines that begin with a single start contain a
> test of whether an unsigned variable or structure field is less than 0.
> The output is actually generated with diff, but I converted the -s to *s
> to avoid confusion.
> diff -u -p a/drivers/scsi/u14-34f.c b/drivers/scsi/u14-34f.c
> *** a/drivers/scsi/u14-34f.c 2008-03-12 14:13:14.000000000 +0100
> @@ -1126,7 +1126,7 @@ static void map_dma(unsigned int i, unsi
>
> if (scsi_bufflen(SCpnt)) {
> count = scsi_dma_map(SCpnt);
> * BUG_ON(count < 0);
>
> scsi_for_each_sg(SCpnt, sg, count, k) {
> cpp->sglist[k].address = H2DEV(sg_dma_address(sg));
----
u14-34f: Correct unsigned comparison against 0
scsi_dma_map() can return an error. The current situation of BUG_ON for
an out of memory condition is far from ideal, but it's better than the
current situation where running out of memory will lead to the driver
trying to walk through 4 billion sg entries.
Discovered-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
diff --git a/drivers/scsi/u14-34f.c b/drivers/scsi/u14-34f.c
index 58d7eee..11df071 100644
--- a/drivers/scsi/u14-34f.c
+++ b/drivers/scsi/u14-34f.c
@@ -1110,7 +1110,7 @@ static int u14_34f_detect(struct scsi_host_template *tpnt) {
static void map_dma(unsigned int i, unsigned int j) {
unsigned int data_len = 0;
- unsigned int k, count, pci_dir;
+ unsigned int k, pci_dir;
struct scatterlist *sg;
struct mscp *cpp;
struct scsi_cmnd *SCpnt;
@@ -1125,7 +1125,7 @@ static void map_dma(unsigned int i, unsigned int j) {
cpp->sense_len = SCSI_SENSE_BUFFERSIZE;
if (scsi_bufflen(SCpnt)) {
- count = scsi_dma_map(SCpnt);
+ int count = scsi_dma_map(SCpnt);
BUG_ON(count < 0);
scsi_for_each_sg(SCpnt, sg, count, k) {
--
Intel are signing my paycheques ... these opinions are still mine
"Bill, look, we understand that you're interested in selling us this
operating system, but compare it to ours. We can't possibly take such
a retrograde step."
prev parent reply other threads:[~2008-04-19 14:17 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <4808C90A.5040600@tiscali.nl>
[not found] ` <Pine.LNX.4.64.0804182101200.14832@ask.diku.dk>
2008-04-19 14:05 ` esp_scsi incorrect unsigned test Matthew Wilcox
2008-04-19 14:16 ` James Bottomley
2008-04-20 0:59 ` David Miller
2008-04-19 14:17 ` Matthew Wilcox [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080419141752.GK20637@parisc-linux.org \
--to=matthew@wil.cx \
--cc=12o3l@tiscali.nl \
--cc=julia@diku.dk \
--cc=kernel-janitors@vger.kernel.org \
--cc=kernelnewbies-bounce@nl.linux.org \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox