Subject: [kbuild] Re: [PATCH 2/5] Huawei BMA: Adding Huawei BMA driver: host_cdev_drv

From: Dan Carpenter <[email-masked]>
Date: Thu, 18 Jun 2020 13:28:16 +0300

Hi,

url:    https://github.com/0day-ci/linux/commits/yunaixin03610-163-com/Adding-Huawei-BMA-drivers/20200616-102318
base:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git a5dc8300df75e8b8384b4c82225f1e4a0b4d9b55
compiler: gcc-9 (Debian 9.3.0-13) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email-masked]>

cppcheck warnings: (new ones prefixed by >>)

>> drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c:149:3: warning: Shifting signed 32-bit value by 31 bits is undefined behaviour [shiftTooManyBitsSigned]
     REGION_DIR_INPUT + (region & REGION_INDEX_MASK));
     ^
   drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c:158:55: warning: Shifting signed 32-bit value by 31 bits is undefined behaviour [shiftTooManyBitsSigned]
    (void)pci_write_config_dword(pdev, ATU_REGION_CTRL2, REGION_ENABLE);
                                                         ^
--
>> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:63:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "lost_count   :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:65:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "b2h_int      :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:67:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "h2b_int      :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:69:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "dma_count    :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:71:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "recv_bytes   :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:73:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "send_bytes   :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:75:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "recv_pkgs    :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:77:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "send_pkgs    :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:79:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "drop_pkgs    :%dn",
           ^
   drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:81:9: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint]
    len += sprintf(buf + len, "fail_count   :%dn",
           ^
>> drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c:326:21: warning: Checking if unsigned variable 'count' is less than zero. [unsignedLessThanZero]
    if (!data || count <= 0)
                       ^
   drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c:346:21: warning: Checking if unsigned variable 'count' is less than zero. [unsignedLessThanZero]
    if (!data || count <= 0)

# https://github.com/0day-ci/linux/commit/d0965c4179b69ddd204c1f795f0d6ac080c657af
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout d0965c4179b69ddd204c1f795f0d6ac080c657af
vim +122 drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c

d0965c4179b69d yunaixin 2020-06-15   93  static int cdev_param_get_statics(char *buf, const struct kernel_param *kp)
d0965c4179b69d yunaixin 2020-06-15   94  {
d0965c4179b69d yunaixin 2020-06-15   95  	int len = 0;
d0965c4179b69d yunaixin 2020-06-15   96  	int i = 0;
d0965c4179b69d yunaixin 2020-06-15   97  	__kernel_time_t running_time = 0;
d0965c4179b69d yunaixin 2020-06-15   98  
d0965c4179b69d yunaixin 2020-06-15   99  	if (!buf)
d0965c4179b69d yunaixin 2020-06-15  100  		return 0;

buf is a PAGE_SIZE buffer.  It can't be NULL.

d0965c4179b69d yunaixin 2020-06-15  101  
d0965c4179b69d yunaixin 2020-06-15  102  	GET_SYS_SECONDS(running_time);
d0965c4179b69d yunaixin 2020-06-15  103  	running_time -= g_cdev_set.init_time;
d0965c4179b69d yunaixin 2020-06-15  104  	len += sprintf(buf + len,
d0965c4179b69d yunaixin 2020-06-15  105  		       "============================CDEV_DRIVER_INFO=======================\n");
d0965c4179b69d yunaixin 2020-06-15  106  	len += sprintf(buf + len, "version      :%s\n", CDEV_VERSION);
d0965c4179b69d yunaixin 2020-06-15  107  
d0965c4179b69d yunaixin 2020-06-15  108  	len += sprintf(buf + len, "running_time :%luD %02lu:%02lu:%02lu\n",
d0965c4179b69d yunaixin 2020-06-15  109  		       running_time / (SECONDS_PER_DAY),
d0965c4179b69d yunaixin 2020-06-15  110  		       running_time % (SECONDS_PER_DAY) / SECONDS_PER_HOUR,
d0965c4179b69d yunaixin 2020-06-15  111  		       running_time % SECONDS_PER_HOUR / SECONDS_PER_MINUTE,
d0965c4179b69d yunaixin 2020-06-15  112  		       running_time % SECONDS_PER_MINUTE);
d0965c4179b69d yunaixin 2020-06-15  113  
d0965c4179b69d yunaixin 2020-06-15  114  	for (i = 0; i < g_cdev_set.dev_num; i++) {
d0965c4179b69d yunaixin 2020-06-15  115  		len += sprintf(buf + len,
d0965c4179b69d yunaixin 2020-06-15  116  			       "===================================================\n");

I'm very worried that the sprintf loop can overflow the PAGE_SIZE.
Please replace all the sprintf() calls with scnprintf().

	len += scnprintf(PAGE_SIZE - len, buf + len, "blah blah");

d0965c4179b69d yunaixin 2020-06-15  117  		len += sprintf(buf + len, "name      :%s\n",
d0965c4179b69d yunaixin 2020-06-15  118  			       g_cdev_set.dev_list[i].dev_name);
d0965c4179b69d yunaixin 2020-06-15  119  		len +=
d0965c4179b69d yunaixin 2020-06-15  120  		    sprintf(buf + len, "dev_id    :%08x\n",
d0965c4179b69d yunaixin 2020-06-15  121  			    g_cdev_set.dev_list[i].dev_id);
d0965c4179b69d yunaixin 2020-06-15 @122  		len += sprintf(buf + len, "type      :%u\n",
d0965c4179b69d yunaixin 2020-06-15  123  			       g_cdev_set.dev_list[i].type);
d0965c4179b69d yunaixin 2020-06-15  124  		len += sprintf(buf + len, "status    :%s\n",
d0965c4179b69d yunaixin 2020-06-15  125  			       g_cdev_set.dev_list[i].s.open_status ==
d0965c4179b69d yunaixin 2020-06-15  126  			       1 ? "open" : "close");
d0965c4179b69d yunaixin 2020-06-15  127  		len += sprintf(buf + len, "send_pkgs :%u\n",
d0965c4179b69d yunaixin 2020-06-15  128  			       g_cdev_set.dev_list[i].s.send_pkgs);
d0965c4179b69d yunaixin 2020-06-15  129  		len +=
d0965c4179b69d yunaixin 2020-06-15  130  		    sprintf(buf + len, "send_bytes:%u\n",
d0965c4179b69d yunaixin 2020-06-15  131  			    g_cdev_set.dev_list[i].s.send_bytes);
d0965c4179b69d yunaixin 2020-06-15  132  		len += sprintf(buf + len, "send_failed_count:%u\n",
d0965c4179b69d yunaixin 2020-06-15  133  			       g_cdev_set.dev_list[i].s.send_failed_count);
d0965c4179b69d yunaixin 2020-06-15  134  		len += sprintf(buf + len, "recv_pkgs :%u\n",
d0965c4179b69d yunaixin 2020-06-15  135  			       g_cdev_set.dev_list[i].s.recv_pkgs);
d0965c4179b69d yunaixin 2020-06-15  136  		len += sprintf(buf + len, "recv_bytes:%u\n",
d0965c4179b69d yunaixin 2020-06-15  137  			       g_cdev_set.dev_list[i].s.recv_bytes);
d0965c4179b69d yunaixin 2020-06-15  138  		len += sprintf(buf + len, "recv_failed_count:%u\n",
d0965c4179b69d yunaixin 2020-06-15  139  			       g_cdev_set.dev_list[i].s.recv_failed_count);
d0965c4179b69d yunaixin 2020-06-15  140  	}
d0965c4179b69d yunaixin 2020-06-15  141  
d0965c4179b69d yunaixin 2020-06-15  142  	return len;
d0965c4179b69d yunaixin 2020-06-15  143  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email-masked]
_______________________________________________
kbuild mailing list -- [email-masked]
To unsubscribe send an email to [email-masked]