linux-kernel - Re: [Patch] Signedness issue in drivers/net/3c515.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20060821140558.4cfee23c.akpm@osdl.org>
Date:	Mon, 21 Aug 2006 14:05:58 -0700
From:	Andrew Morton <akpm@...l.org>
To:	Eric Sesterhenn <snakebyte@....de>
Cc:	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	Jeff Garzik <jeff@...zik.org>
Subject: Re: [Patch] Signedness issue in drivers/net/3c515.c

On Sat, 19 Aug 2006 19:37:57 +0200
Eric Sesterhenn <snakebyte@....de> wrote:

> while playing with gcc 4.1 -Wextra warnings, I came across this one:
> 
> drivers/net/3c515.c:1027: warning: comparison of unsigned expression >= 0 is always true
> 
> Since i is unsigned the >= 0 check in the for loop is always true,
> so we might spin there forever unless the if condition triggers.
> Since i is only used in this loop, this patch changes it to
> an integer.
> 
> Signed-off-by: Eric Sesterhenn <snakebyte@....de>
> 
> --- linux-2.6.18-rc4/drivers/net/3c515.c.orig	2006-08-19 19:35:04.000000000 +0200
> +++ linux-2.6.18-rc4/drivers/net/3c515.c	2006-08-19 19:35:14.000000000 +0200
> @@ -1003,7 +1003,8 @@ static int corkscrew_start_xmit(struct s
>  		/* Calculate the next Tx descriptor entry. */
>  		int entry = vp->cur_tx % TX_RING_SIZE;
>  		struct boom_tx_desc *prev_entry;
> -		unsigned long flags, i;
> +		unsigned long flags;
> +		int i;
>  
>  		if (vp->tx_full)	/* No room to transmit with */
>  			return 1;

Which affects this loop:

	/* Wait for the stall to complete. */
	for (i = 20; i >= 0; i--)
		if ((inw(ioaddr + EL3_STATUS) & CmdInProgress) == 0) 
			break;

Your fix will convert this indefinit wait into a bounded one.  It might
cause the driver to malfunction.

Given that our pool of 3c515 testers is less than enormous, a more prudent
change might be to remove `i' and simply formalise the existing behaviour
into a while(1) loop.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/