From patchwork Sat Jul 4 21:31:47 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Julia Lawall X-Patchwork-Id: 29460 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id F2942B6F35 for ; Sun, 5 Jul 2009 07:32:00 +1000 (EST) Received: by ozlabs.org (Postfix) id E77A1DDD0C; Sun, 5 Jul 2009 07:32:00 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 73B37DDD04 for ; Sun, 5 Jul 2009 07:32:00 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752822AbZGDVbt (ORCPT ); Sat, 4 Jul 2009 17:31:49 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752508AbZGDVbs (ORCPT ); Sat, 4 Jul 2009 17:31:48 -0400 Received: from mgw1.diku.dk ([130.225.96.91]:56156 "EHLO mgw1.diku.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752340AbZGDVbr (ORCPT ); Sat, 4 Jul 2009 17:31:47 -0400 Received: from localhost (localhost [127.0.0.1]) by mgw1.diku.dk (Postfix) with ESMTP id 92E3A52C487; Sat, 4 Jul 2009 23:31:49 +0200 (CEST) X-Virus-Scanned: amavisd-new at diku.dk Received: from mgw1.diku.dk ([127.0.0.1]) by localhost (mgw1.diku.dk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LBhesrePsOcl; Sat, 4 Jul 2009 23:31:47 +0200 (CEST) Received: from nhugin.diku.dk (nhugin.diku.dk [130.225.96.140]) by mgw1.diku.dk (Postfix) with ESMTP id 722DA52C482; Sat, 4 Jul 2009 23:31:47 +0200 (CEST) Received: from ask.diku.dk (ask.diku.dk [130.225.96.225]) by nhugin.diku.dk (Postfix) with ESMTP id 832BE6DF88D; Sat, 4 Jul 2009 23:31:35 +0200 (CEST) Received: by ask.diku.dk (Postfix, from userid 3767) id 5C49A1548BA; Sat, 4 Jul 2009 23:31:47 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by ask.diku.dk (Postfix) with ESMTP id 59CDA1547DF; Sat, 4 Jul 2009 23:31:47 +0200 (CEST) Date: Sat, 4 Jul 2009 23:31:47 +0200 (CEST) From: Julia Lawall To: steve.glendinning@smsc.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH 1/3] drivers/net/smsc911x.c: Fix resource size off by 1 error Message-ID: MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Julia Lawall The call resource_size(res) returns res->end - res->start + 1 and thus the second change is semantics-preserving. res_size is then used as the second argument of a call to request_mem_region, and the memory allocated by this call appears to be the same as what is released in the two calls to release_mem_region. So the size argument for those calls should be resource_size(size) as well. Alternatively, in the second call to release_mem_region, the second argument could be res_size, as that variable has already been initialized at the point of this call. The problem was found using the following semantic patch: (http://www.emn.fr/x-info/coccinelle/) // @@ struct resource *res; @@ - (res->end - res->start) + 1 + resource_size(res) @@ struct resource *res; @@ - res->end - res->start + BAD(resource_size(res)) // Signed-off-by: Julia Lawall --- drivers/net/smsc911x.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff -u -p a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c --- a/drivers/net/smsc911x.c 2009-06-24 21:18:49.000000000 +0200 +++ b/drivers/net/smsc911x.c 2009-07-04 21:38:00.000000000 +0200 @@ -1938,7 +1938,7 @@ static int __devexit smsc911x_drv_remove if (!res) res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - release_mem_region(res->start, res->end - res->start); + release_mem_region(res->start, resource_size(res)); iounmap(pdata->ioaddr); @@ -1976,7 +1976,7 @@ static int __devinit smsc911x_drv_probe( retval = -ENODEV; goto out_0; } - res_size = res->end - res->start + 1; + res_size = resource_size(res); irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); if (!irq_res) { @@ -2104,7 +2104,7 @@ out_unmap_io_3: out_free_netdev_2: free_netdev(dev); out_release_io_1: - release_mem_region(res->start, res->end - res->start); + release_mem_region(res->start, resource_size(res)); out_0: return retval; }