* [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression @ 2013-07-12 8:26 Hayes Wang 2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang 2013-07-12 23:13 ` [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression David Miller 0 siblings, 2 replies; 5+ messages in thread From: Hayes Wang @ 2013-07-12 8:26 UTC (permalink / raw) To: gregkh; +Cc: netdev, linux-kernel, linux-usb, Hayes Wang config: make ARCH=avr32 allyesconfig drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit': drivers/net/usb/r8152.c:956: warning: integer overflow in expression 955 memset(tx_desc, 0, sizeof(*tx_desc)); > 956 tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS); 957 tp->tx_skb = skb; Signed-off-by: Hayes Wang <hayeswang@realtek.com> Spotted-by: kbuild test robot <fengguang.wu@intel.com> --- drivers/net/usb/r8152.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c index d02bac8..ee13f9e 100644 --- a/drivers/net/usb/r8152.c +++ b/drivers/net/usb/r8152.c @@ -934,7 +934,8 @@ static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb, struct r8152 *tp = netdev_priv(netdev); struct net_device_stats *stats = rtl8152_get_stats(netdev); struct tx_desc *tx_desc; - int len, res; + unsigned int len; + int res; netif_stop_queue(netdev); len = skb->len; -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 2013-07-12 8:26 [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression Hayes Wang @ 2013-07-12 8:26 ` Hayes Wang 2013-07-12 23:14 ` David Miller 2013-07-15 18:45 ` Ben Hutchings 2013-07-12 23:13 ` [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression David Miller 1 sibling, 2 replies; 5+ messages in thread From: Hayes Wang @ 2013-07-12 8:26 UTC (permalink / raw) To: gregkh; +Cc: netdev, linux-kernel, linux-usb, Hayes Wang >> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32 >> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32 >> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types) drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident> Signed-off-by: Hayes Wang <hayeswang@realtek.com> Spotted-by: kbuild test robot <fengguang.wu@intel.com> --- drivers/net/usb/r815x.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c index 6516737..8523922 100644 --- a/drivers/net/usb/r815x.c +++ b/drivers/net/usb/r815x.c @@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index) { int data, ret; u8 shift = index & 2; + __le32 ocp_data; index &= ~3; ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), RTL815x_REQ_GET_REGS, RTL815x_REQT_READ, - index, MCU_TYPE_PLA, &data, sizeof(data), 500); + index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data), + 500); if (ret < 0) return ret; - data = __le32_to_cpu(data); + data = __le32_to_cpu(ocp_data); data >>= (shift * 8); data &= 0xffff; @@ -44,7 +46,8 @@ static int pla_read_word(struct usb_device *udev, u16 index) static int pla_write_word(struct usb_device *udev, u16 index, u32 data) { - u32 tmp, mask = 0xffff; + __le32 ocp_data; + u32 mask = 0xffff; u16 byen = BYTE_EN_WORD; u8 shift = index & 2; int ret; @@ -60,18 +63,18 @@ static int pla_write_word(struct usb_device *udev, u16 index, u32 data) ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), RTL815x_REQ_GET_REGS, RTL815x_REQT_READ, - index, MCU_TYPE_PLA, &tmp, sizeof(tmp), 500); + index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data), + 500); if (ret < 0) return ret; - tmp = __le32_to_cpu(tmp) & ~mask; - tmp |= data; - tmp = __cpu_to_le32(tmp); + data |= __le32_to_cpu(ocp_data) & ~mask; + ocp_data = __cpu_to_le32(data); ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE, - index, MCU_TYPE_PLA | byen, &tmp, - sizeof(tmp), 500); + index, MCU_TYPE_PLA | byen, &ocp_data, + sizeof(ocp_data), 500); return ret; } -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang @ 2013-07-12 23:14 ` David Miller 2013-07-15 18:45 ` Ben Hutchings 1 sibling, 0 replies; 5+ messages in thread From: David Miller @ 2013-07-12 23:14 UTC (permalink / raw) To: hayeswang; +Cc: gregkh, netdev, linux-kernel, linux-usb From: Hayes Wang <hayeswang@realtek.com> Date: Fri, 12 Jul 2013 16:26:16 +0800 >>> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32 >>> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32 >>> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types) > drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp > drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident> > > Signed-off-by: Hayes Wang <hayeswang@realtek.com> > Spotted-by: kbuild test robot <fengguang.wu@intel.com> Applied. ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang 2013-07-12 23:14 ` David Miller @ 2013-07-15 18:45 ` Ben Hutchings 1 sibling, 0 replies; 5+ messages in thread From: Ben Hutchings @ 2013-07-15 18:45 UTC (permalink / raw) To: Hayes Wang; +Cc: gregkh, netdev, linux-kernel, linux-usb On Fri, 2013-07-12 at 16:26 +0800, Hayes Wang wrote: > >> drivers/net/usb/r815x.c:38:16: sparse: cast to restricted __le32 > >> drivers/net/usb/r815x.c:67:15: sparse: cast to restricted __le32 > >> drivers/net/usb/r815x.c:69:13: sparse: incorrect type in assignment (different base types) > drivers/net/usb/r815x.c:69:13: expected unsigned int [unsigned] [addressable] [assigned] [usertype] tmp > drivers/net/usb/r815x.c:69:13: got restricted __le32 [usertype] <noident> > > Signed-off-by: Hayes Wang <hayeswang@realtek.com> > Spotted-by: kbuild test robot <fengguang.wu@intel.com> > --- > drivers/net/usb/r815x.c | 21 ++++++++++++--------- > 1 file changed, 12 insertions(+), 9 deletions(-) > > diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c > index 6516737..8523922 100644 > --- a/drivers/net/usb/r815x.c > +++ b/drivers/net/usb/r815x.c > @@ -26,16 +26,18 @@ static int pla_read_word(struct usb_device *udev, u16 index) > { > int data, ret; > u8 shift = index & 2; > + __le32 ocp_data; > > index &= ~3; > > ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), > RTL815x_REQ_GET_REGS, RTL815x_REQT_READ, > - index, MCU_TYPE_PLA, &data, sizeof(data), 500); > + index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data), > + 500); [...] There seems to be another bug here: USB buffers must be DMA-able, therefore cannot be placed on the stack. Ben. -- Ben Hutchings, Staff Engineer, Solarflare Not speaking for my employer; that's the marketing department's job. They asked us to note that Solarflare product names are trademarked. ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression 2013-07-12 8:26 [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression Hayes Wang 2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang @ 2013-07-12 23:13 ` David Miller 1 sibling, 0 replies; 5+ messages in thread From: David Miller @ 2013-07-12 23:13 UTC (permalink / raw) To: hayeswang; +Cc: gregkh, netdev, linux-kernel, linux-usb From: Hayes Wang <hayeswang@realtek.com> Date: Fri, 12 Jul 2013 16:26:15 +0800 > config: make ARCH=avr32 allyesconfig > drivers/net/usb/r8152.c: In function 'rtl8152_start_xmit': > drivers/net/usb/r8152.c:956: warning: integer overflow in expression > > 955 memset(tx_desc, 0, sizeof(*tx_desc)); > > 956 tx_desc->opts1 = cpu_to_le32((len & TX_LEN_MASK) | TX_FS | TX_LS); > 957 tp->tx_skb = skb; > > Signed-off-by: Hayes Wang <hayeswang@realtek.com> > Spotted-by: kbuild test robot <fengguang.wu@intel.com> Applied. ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-07-15 18:45 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-07-12 8:26 [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression Hayes Wang 2013-07-12 8:26 ` [PATCH net 2/2] usb/net/r815x: fix cast to restricted __le32 Hayes Wang 2013-07-12 23:14 ` David Miller 2013-07-15 18:45 ` Ben Hutchings 2013-07-12 23:13 ` [PATCH net 1/2] usb/net/r8152: fix integer overflow in expression David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).