linux-kernel - cnic: issue with double assignment to ictx->xstorm_st

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <45fd66c6-764b-bc0d-7ff9-920db399f11b@canonical.com>
Date:   Fri, 9 Apr 2021 11:29:24 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     Vladislav Zolotarov <vladz@...adcom.com>,
        Michael Chan <mchan@...adcom.com>,
        Bhanu Prakash Gollapudi <bprakash@...adcom.com>,
        Eilon Greenstein <eilong@...adcom.com>
Cc:     "David S. Miller" <davem@...an.davemloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Saurav Kashyap <skashyap@...vell.com>,
        Javed Hasan <jhasan@...vell.com>,
        GR-QLogic-Storage-Upstream@...vell.com,
        Nilesh Javali <njavali@...vell.com>,
        Manish Rangankar <mrangankar@...vell.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: cnic: issue with double assignment to
 ictx->xstorm_st_context.common.flags

Hi,

Analysis of linux with Coverity has detected an issue with the
assignment of ictx->xstorm_st_context.common.fla in
drivers/net/ethernet/broadcom/cnic.c in function cnic_setup_bnx2x_ctx.

This was introduced a while back with the following commit:

commit 619c5cb6885b936c44ae1422ef805b69c6291485
Author: Vlad Zolotarov <vladz@...adcom.com>
Date:   Tue Jun 14 14:33:44 2011 +0300

    New 7.0 FW: bnx2x, cnic, bnx2i, bnx2fc

The static analysis is as follows:

1761        ictx->xstorm_st_context.common.flags =

Unused value (UNUSED_VALUE)assigned_value: Assigning value 1 to
ictx->xstorm_st_context.common.flags here, but that stored value is
overwritten before it can be used.

1762                1 <<
XSTORM_COMMON_CONTEXT_SECTION_PHYSQ_INITIALIZED_SHIFT;
1763        ictx->xstorm_st_context.common.flags =

    value_overwrite: Overwriting previous write to
ictx->xstorm_st_context.common.flags with value from port << 1.

1764                port << XSTORM_COMMON_CONTEXT_SECTION_PBF_PORT_SHIFT;
1765
1766        ictx->tstorm_st_context.iscsi.hdr_bytes_2_fetch =
ISCSI_HEADER_SIZE;

The re-assignment of ictx->xstorm_st_context.common.flags in line 1763
is overwriting the value assigned on line 1761.  Should the = operator
on the re-assignment be an |= operator instead?

Colin