| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 18 Jun 2020 13:28:16 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: kbuild@...ts.01.org, yunaixin03610@....com, netdev@...r.kernel.org
Cc: lkp@...el.com, kbuild-all@...ts.01.org,
yunaixin <yunaixin@...wei.com>
Subject: [kbuild] Re: [PATCH 2/5] Huawei BMA: Adding Huawei BMA driver:
host_cdev_drv
Hi,
url: https://github.com/0day-ci/linux/commits/yunaixin03610-163-com/Adding-Huawei-BMA-drivers/20200616-102318
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git a5dc8300df75e8b8384b4c82225f1e4a0b4d9b55
compiler: gcc-9 (Debian 9.3.0-13) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
cppcheck warnings: (new ones prefixed by >>)
>> drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c:149:3: warning: Shifting signed 32-bit value by 31 bits is undefined behaviour [shiftTooManyBitsSigned]
REGION_DIR_INPUT + (region & REGION_INDEX_MASK));
^
drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c:158:55: warning: Shifting signed 32-bit value by 31 bits is undefined behaviour [shiftTooManyBitsSigned]
(void)pci_write_config_dword(pdev, ATU_REGION_CTRL2, REGION_ENABLE);
^
--
>> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:63:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "lost_count :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:65:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "b2h_int :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:67:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "h2b_int :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:69:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "dma_count :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:71:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "recv_bytes :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:73:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "send_bytes :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:75:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "recv_pkgs :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:77:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "send_pkgs :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:79:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "drop_pkgs :%dn",
^
drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:81:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
len += sprintf(buf + len, "fail_count :%dn",
^
>> drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c:326:21: warning: Checking if unsigned variable 'count' is less than zero. [unsignedLessThanZero]
if (!data || count <= 0)
^
drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c:346:21: warning: Checking if unsigned variable 'count' is less than zero. [unsignedLessThanZero]
if (!data || count <= 0)
# https://github.com/0day-ci/linux/commit/d0965c4179b69ddd204c1f795f0d6ac080c657af
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout d0965c4179b69ddd204c1f795f0d6ac080c657af
vim +122 drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c
d0965c4179b69d yunaixin 2020-06-15 93 static int cdev_param_get_statics(char *buf, const struct kernel_param *kp)
d0965c4179b69d yunaixin 2020-06-15 94 {
d0965c4179b69d yunaixin 2020-06-15 95 int len = 0;
d0965c4179b69d yunaixin 2020-06-15 96 int i = 0;
d0965c4179b69d yunaixin 2020-06-15 97 __kernel_time_t running_time = 0;
d0965c4179b69d yunaixin 2020-06-15 98
d0965c4179b69d yunaixin 2020-06-15 99 if (!buf)
d0965c4179b69d yunaixin 2020-06-15 100 return 0;
buf is a PAGE_SIZE buffer. It can't be NULL.
d0965c4179b69d yunaixin 2020-06-15 101
d0965c4179b69d yunaixin 2020-06-15 102 GET_SYS_SECONDS(running_time);
d0965c4179b69d yunaixin 2020-06-15 103 running_time -= g_cdev_set.init_time;
d0965c4179b69d yunaixin 2020-06-15 104 len += sprintf(buf + len,
d0965c4179b69d yunaixin 2020-06-15 105 "============================CDEV_DRIVER_INFO=======================\n");
d0965c4179b69d yunaixin 2020-06-15 106 len += sprintf(buf + len, "version :%s\n", CDEV_VERSION);
d0965c4179b69d yunaixin 2020-06-15 107
d0965c4179b69d yunaixin 2020-06-15 108 len += sprintf(buf + len, "running_time :%luD %02lu:%02lu:%02lu\n",
d0965c4179b69d yunaixin 2020-06-15 109 running_time / (SECONDS_PER_DAY),
d0965c4179b69d yunaixin 2020-06-15 110 running_time % (SECONDS_PER_DAY) / SECONDS_PER_HOUR,
d0965c4179b69d yunaixin 2020-06-15 111 running_time % SECONDS_PER_HOUR / SECONDS_PER_MINUTE,
d0965c4179b69d yunaixin 2020-06-15 112 running_time % SECONDS_PER_MINUTE);
d0965c4179b69d yunaixin 2020-06-15 113
d0965c4179b69d yunaixin 2020-06-15 114 for (i = 0; i < g_cdev_set.dev_num; i++) {
d0965c4179b69d yunaixin 2020-06-15 115 len += sprintf(buf + len,
d0965c4179b69d yunaixin 2020-06-15 116 "===================================================\n");
I'm very worried that the sprintf loop can overflow the PAGE_SIZE.
Please replace all the sprintf() calls with scnprintf().
len += scnprintf(PAGE_SIZE - len, buf + len, "blah blah");
d0965c4179b69d yunaixin 2020-06-15 117 len += sprintf(buf + len, "name :%s\n",
d0965c4179b69d yunaixin 2020-06-15 118 g_cdev_set.dev_list[i].dev_name);
d0965c4179b69d yunaixin 2020-06-15 119 len +=
d0965c4179b69d yunaixin 2020-06-15 120 sprintf(buf + len, "dev_id :%08x\n",
d0965c4179b69d yunaixin 2020-06-15 121 g_cdev_set.dev_list[i].dev_id);
d0965c4179b69d yunaixin 2020-06-15 @122 len += sprintf(buf + len, "type :%u\n",
d0965c4179b69d yunaixin 2020-06-15 123 g_cdev_set.dev_list[i].type);
d0965c4179b69d yunaixin 2020-06-15 124 len += sprintf(buf + len, "status :%s\n",
d0965c4179b69d yunaixin 2020-06-15 125 g_cdev_set.dev_list[i].s.open_status ==
d0965c4179b69d yunaixin 2020-06-15 126 1 ? "open" : "close");
d0965c4179b69d yunaixin 2020-06-15 127 len += sprintf(buf + len, "send_pkgs :%u\n",
d0965c4179b69d yunaixin 2020-06-15 128 g_cdev_set.dev_list[i].s.send_pkgs);
d0965c4179b69d yunaixin 2020-06-15 129 len +=
d0965c4179b69d yunaixin 2020-06-15 130 sprintf(buf + len, "send_bytes:%u\n",
d0965c4179b69d yunaixin 2020-06-15 131 g_cdev_set.dev_list[i].s.send_bytes);
d0965c4179b69d yunaixin 2020-06-15 132 len += sprintf(buf + len, "send_failed_count:%u\n",
d0965c4179b69d yunaixin 2020-06-15 133 g_cdev_set.dev_list[i].s.send_failed_count);
d0965c4179b69d yunaixin 2020-06-15 134 len += sprintf(buf + len, "recv_pkgs :%u\n",
d0965c4179b69d yunaixin 2020-06-15 135 g_cdev_set.dev_list[i].s.recv_pkgs);
d0965c4179b69d yunaixin 2020-06-15 136 len += sprintf(buf + len, "recv_bytes:%u\n",
d0965c4179b69d yunaixin 2020-06-15 137 g_cdev_set.dev_list[i].s.recv_bytes);
d0965c4179b69d yunaixin 2020-06-15 138 len += sprintf(buf + len, "recv_failed_count:%u\n",
d0965c4179b69d yunaixin 2020-06-15 139 g_cdev_set.dev_list[i].s.recv_failed_count);
d0965c4179b69d yunaixin 2020-06-15 140 }
d0965c4179b69d yunaixin 2020-06-15 141
d0965c4179b69d yunaixin 2020-06-15 142 return len;
d0965c4179b69d yunaixin 2020-06-15 143 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
_______________________________________________
kbuild mailing list -- kbuild@...ts.01.org
To unsubscribe send an email to kbuild-leave@...ts.01.org
Powered by blists - more mailing lists