| Message ID | 20181012194948.GA24925@embeddedor.com |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net-next] net: ena: fix unintended sign extension | expand |
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com> Date: Fri, 12 Oct 2018 21:49:48 +0200 > In the following expression: > > 372 size = io_sq->bounce_buf_ctrl.buffer_size * > 373 io_sq->bounce_buf_ctrl.buffers_num; > > both buffer_size and buffers_num are of type u16 (16 bits, unsigned), > so they are promoted to type int (32 bits, signed) and then > sign-extended to type size_t. > > Fix this by casting io_sq->bounce_buf_ctrl.buffer_size to size_t in > order to avoid the sign extension and unintended results. > > Addresses-Coverity-ID: 1474187 ("Unintended sign extension") > Addresses-Coverity-ID: 1474189 ("Unintended sign extension") > Fixes: 689b2bdaaa14 ("net: ena: add functions for handling Low Latency Queues in ena_com") > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> I don't understand how this can possibly be a real problem, and it looks therefore like we are just papering over a coverity warning. I'm not applying this without more information and justification.
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c index 420cede..9a8130e 100644 --- a/drivers/net/ethernet/amazon/ena/ena_com.c +++ b/drivers/net/ethernet/amazon/ena/ena_com.c @@ -369,7 +369,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev, ENA_COM_BOUNCE_BUFFER_CNTRL_CNT; io_sq->bounce_buf_ctrl.next_to_use = 0; - size = io_sq->bounce_buf_ctrl.buffer_size * + size = (size_t)io_sq->bounce_buf_ctrl.buffer_size * io_sq->bounce_buf_ctrl.buffers_num; dev_node = dev_to_node(ena_dev->dmadev);
In the following expression: 372 size = io_sq->bounce_buf_ctrl.buffer_size * 373 io_sq->bounce_buf_ctrl.buffers_num; both buffer_size and buffers_num are of type u16 (16 bits, unsigned), so they are promoted to type int (32 bits, signed) and then sign-extended to type size_t. Fix this by casting io_sq->bounce_buf_ctrl.buffer_size to size_t in order to avoid the sign extension and unintended results. Addresses-Coverity-ID: 1474187 ("Unintended sign extension") Addresses-Coverity-ID: 1474189 ("Unintended sign extension") Fixes: 689b2bdaaa14 ("net: ena: add functions for handling Low Latency Queues in ena_com") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> --- drivers/net/ethernet/amazon/ena/ena_com.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)