netdev - issue with unreachable code in net sxgbe driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 9 Jul 2021 15:03:32 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     Byungho An <bh74.an@...sung.com>,
        Siva Reddy <siva.kallam@...sung.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: issue with unreachable code in net sxgbe driver

Hi,

Static analysis with Coverity has detected several occurrences of dead
code in the sxgbe driver in function sxgbe_mtl_init. The issue was
introduced with the following commit:

commit 1edb9ca69e8a7988900fc0283e10550b5592164d
Author: Siva Reddy <siva.kallam@...sung.com>
Date:   Tue Mar 25 12:10:54 2014 -0700

    net: sxgbe: add basic framework for Samsung 10Gb ethernet driver

The analysis is as follows:

 20static void sxgbe_mtl_init(void __iomem *ioaddr, unsigned int etsalg,
 21                           unsigned int raa)
 22{
 23        u32 reg_val;
 24
 25        reg_val = readl(ioaddr + SXGBE_MTL_OP_MODE_REG);
 26        reg_val &= ETS_RST;
 27
 28        /* ETS Algorith */
 29        switch (etsalg & SXGBE_MTL_OPMODE_ESTMASK) {

Logically dead code (DEADCODE)

 30        case ETS_WRR:
 31                reg_val &= ETS_WRR;
 32                break;


Logically dead code (DEADCODE)

 33        case ETS_WFQ:
 34                reg_val |= ETS_WFQ;
 35                break;

Logically dead code (DEADCODE)

 36        case ETS_DWRR:
 37                reg_val |= ETS_DWRR;
 38                break;
 39        }

SXGBE_MTL_OPMODE_ESTMASK is defined as 0x03
ETS_WRR is 0xFFFFFF9F
ETS_WFQ is 0x00000020
ETS_DWRR is 0x00000040

so the masking of etsalg & SXGBE_MTL_OPMODE_ESTMASK will never match any
of the ETS_* values, hence the dead code.


 40        writel(reg_val, ioaddr + SXGBE_MTL_OP_MODE_REG);
 41
 42        switch (raa & SXGBE_MTL_OPMODE_RAAMASK) {

Logically dead code (DEADCODE)

 43        case RAA_SP:
 44                reg_val &= RAA_SP;
 45                break;

Logically dead code (DEADCODE)

 46        case RAA_WSP:
 47                reg_val |= RAA_WSP;
 48                break;
 49        }
 50        writel(reg_val, ioaddr + SXGBE_MTL_OP_MODE_REG);
 51}

SXGBE_MTL_OPMODE_RAAMASK is defined as 0x1
RAA_SP is 0xFFFFFFFB
RAA_WSP is 0x00000004

so masking of raa & SXGBE_MTL_OPMODE_RAAMASK will never match any of the
RAA_* values, hence the dead code.

I don't think this is intentional. Not sure how to fix this hence I'm
reporting this issue.

Regards,

Colin