Patchwork net/sun3_82586: Kill array subscript above array bounds warning

login
register
mail settings
Submitter Geert Uytterhoeven
Date July 17, 2013, 12:25 p.m.
Message ID <1374063905-4050-1-git-send-email-geert@linux-m68k.org>
Download mbox | patch
Permalink /patch/259691/
State Changes Requested
Delegated to: David Miller
Headers show

Comments

Geert Uytterhoeven - July 17, 2013, 12:25 p.m.
drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout':
drivers/net/ethernet/i825xx/sun3_82586.c:993:89: warning: array subscript is above array bounds [-Warray-bounds]

Using the default NUM_XMIT_BUFFS = 1, there's only one transmit buffer.
Hence accessing the second buffer is an out-of-bounds access.
Print the command status of the first NOP buffer instead.

Fortunately this actually worked fine, as the layout of transmit and NOP
buffers is sufficiently similar.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
---
  - Untested due to lack of hardware
  - Note that the driver never compiled with the non-default NUM_XMIT_BUFFS > 1

 drivers/net/ethernet/i825xx/sun3_82586.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
David Miller - July 18, 2013, 1:22 a.m.
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Wed, 17 Jul 2013 14:25:05 +0200

> drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout':
> drivers/net/ethernet/i825xx/sun3_82586.c:993:89: warning: array subscript is above array bounds [-Warray-bounds]
> 
> Using the default NUM_XMIT_BUFFS = 1, there's only one transmit buffer.
> Hence accessing the second buffer is an out-of-bounds access.
> Print the command status of the first NOP buffer instead.
> 
> Fortunately this actually worked fine, as the layout of transmit and NOP
> buffers is sufficiently similar.
> 
> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>

Three more CPP directives in a DEBUG ifdef'd piece of code, yuck.

I'd say just kill this whole DEBUG section entirely.  If people
want this driver to print this debugging, do it properly with
netif_err() or similar.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Geert Uytterhoeven - July 18, 2013, 7:04 a.m.
On Thu, Jul 18, 2013 at 3:22 AM, David Miller <davem@davemloft.net> wrote:
>> drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout':
>> drivers/net/ethernet/i825xx/sun3_82586.c:993:89: warning: array subscript is above array bounds [-Warray-bounds]
>>
>> Using the default NUM_XMIT_BUFFS = 1, there's only one transmit buffer.
>> Hence accessing the second buffer is an out-of-bounds access.
>> Print the command status of the first NOP buffer instead.
>>
>> Fortunately this actually worked fine, as the layout of transmit and NOP
>> buffers is sufficiently similar.
>>
>> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
>
> Three more CPP directives in a DEBUG ifdef'd piece of code, yuck.
>
> I'd say just kill this whole DEBUG section entirely.  If people
> want this driver to print this debugging, do it properly with
> netif_err() or similar.

Yeah, this driver could use some major cleanup. I had to protect my eyes while
fixing the compiler warning.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c
index 353f57f6..d283d2e 100644
--- a/drivers/net/ethernet/i825xx/sun3_82586.c
+++ b/drivers/net/ethernet/i825xx/sun3_82586.c
@@ -990,7 +990,14 @@  static void sun3_82586_timeout(struct net_device *dev)
 	{
 #ifdef DEBUG
 		printk("%s: xmitter timed out, try to restart! stat: %02x\n",dev->name,p->scb->cus);
-		printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status));
+		printk("%s: command-stats: %04x %04x\n", dev->name,
+		       swab16(p->xmit_cmds[0]->cmd_status),
+#if (NUM_XMIT_BUFFS > 1)
+		       swab16(p->xmit_cmds[1]->cmd_status)
+#else
+		       swab16(p->nop_cmds[0]->cmd_status)
+#endif
+		);
 		printk("%s: check, whether you set the right interrupt number!\n",dev->name);
 #endif
 		sun3_82586_close(dev);