nvme: Fix wrong ndev->queues memset

PATCH New Bin Meng 2 participants 9 messages Sep 2, 2017 – Sep 4, 2017

lore

Share & tools

lore

Bin Meng

author

2017-09-02 15:15 UTC #0 lore raw

PATCH 1/3 nvme: Fix wrong ndev->queues memset

memset() was given a sizeof(NVME_Q_NUM * sizeof(struct nvme_queue *) to clear, which is wrong.

Reported-by Coverity (CID: 166729)

Signed-off-by Bin Meng <[email protected]>

---

 drivers/nvme/nvme.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

drivers/nvme/nvme.c +1 -2

index ec32d0d..4448754 100644
@@ -791,8 +791,7 @@ static int nvme_probe(struct udevice *udev)
 		printf("Error: %s: Out of memory!\n", udev->name);
 		goto free_nvme;
 	}
-	memset(ndev->queues, 0,
-	       sizeof(NVME_Q_NUM * sizeof(struct nvme_queue *)));
+	memset(ndev->queues, 0, NVME_Q_NUM * sizeof(struct nvme_queue *));
 
 	ndev->prp_pool = malloc(MAX_PRP_POOL);
 	if (!ndev->prp_pool) {

Signature · 1 line

2.9.2

Bin Meng

author

2017-09-02 15:15 UTC #1 lore raw

PATCH 2/3 nvme: Fix potential sign extension issue in nvme_blk_rw()

"lbas" with type "u16" (16 bits, unsigned) is promoted in "lbas << ns->lba_shift" to type "int" (32 bits, signed), then sign-extended to type "unsigned long long" (64 bits, unsigned). If "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.

Fix it by casting "lbas" to "u32".

Reported-by Coverity (CID: 166730)

Signed-off-by Bin Meng <[email protected]>

---

 drivers/nvme/nvme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/nvme/nvme.c +1 -1

index 4448754..59d54eb 100644
@@ -723,7 +723,7 @@ static ulong nvme_blk_rw(struct udevice *udev, lbaint_t blknr,
 				&c, NULL, IO_TIMEOUT);
 		if (status)
 			break;
-		temp_len -= lbas << ns->lba_shift;
+		temp_len -= (u32)lbas << ns->lba_shift;
 		buffer += lbas << ns->lba_shift;
 	}

Signature · 1 line

2.9.2

Tom Rini

2017-09-02 15:23 UTC #2 lore raw

PATCH 2/3 nvme: Fix potential sign extension issue in nvme_blk_rw()

Quoted 10 lines · Bin Meng

"lbas" with type "u16" (16 bits, unsigned) is promoted in "lbas << ns->lba_shift" to type "int" (32 bits, signed), then sign-extended to type "unsigned long long" (64 bits, unsigned). If "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
Fix it by casting "lbas" to "u32".
Reported-by Coverity (CID: 166730)
Signed-off-by Bin Meng <[email protected]>

Reviewed-by Tom Rini <[email protected]>

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170902/ea786043/attachment.sig>

Tom Rini

2017-09-04 00:42 UTC #3 lore raw

PATCH 2/3 nvme: Fix potential sign extension issue in nvme_blk_rw()

In reply to Bin Meng

Quoted 11 lines · Bin Meng

"lbas" with type "u16" (16 bits, unsigned) is promoted in "lbas << ns->lba_shift" to type "int" (32 bits, signed), then sign-extended to type "unsigned long long" (64 bits, unsigned). If "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
Fix it by casting "lbas" to "u32".
Reported-by Coverity (CID: 166730)
Signed-off-by Bin Meng <[email protected]>
Reviewed-by Tom Rini <[email protected]>

Applied to u-boot/master, thanks!

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170903/8cb6da61/attachment.sig>

Bin Meng

author

2017-09-02 15:15 UTC #4 lore raw

PATCH 3/3 nvme: Remove dead codes in nvme_setup_io_queues()

In reply to Bin Meng

Execution cannot reach this statement: "nr_io_queues = result;"

Reported-by Coverity (CID: 166731)

Signed-off-by Bin Meng <[email protected]>

---

 drivers/nvme/nvme.c | 3 ---
 1 file changed, 3 deletions(-)

drivers/nvme/nvme.c +0 -3

index 59d54eb..1c3519b 100644
@@ -562,9 +562,6 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
 	if (result <= 0)
 		return result;
 
-	if (result < nr_io_queues)
-		nr_io_queues = result;
-
 	dev->max_qid = nr_io_queues;
 
 	/* Free previously allocated queues */

Signature · 1 line

2.9.2

Tom Rini

2017-09-02 15:23 UTC #5 lore raw

PATCH 3/3 nvme: Remove dead codes in nvme_setup_io_queues()

Quoted 4 lines · Bin Meng

Execution cannot reach this statement: "nr_io_queues = result;"
Reported-by Coverity (CID: 166731)
Signed-off-by Bin Meng <[email protected]>

Reviewed-by Tom Rini <[email protected]>

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170902/b3bd3b16/attachment.sig>

Tom Rini

2017-09-04 00:42 UTC #6 lore raw

PATCH 3/3 nvme: Remove dead codes in nvme_setup_io_queues()

In reply to Bin Meng

Quoted 5 lines · Bin Meng

Execution cannot reach this statement: "nr_io_queues = result;"
Reported-by Coverity (CID: 166731)
Signed-off-by Bin Meng <[email protected]>
Reviewed-by Tom Rini <[email protected]>

Applied to u-boot/master, thanks!

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170903/f790999c/attachment.sig>

Tom Rini

2017-09-02 15:23 UTC #7 lore raw

PATCH 1/3 nvme: Fix wrong ndev->queues memset

In reply to Bin Meng

Quoted 5 lines · Bin Meng

memset() was given a sizeof(NVME_Q_NUM * sizeof(struct nvme_queue *) to clear, which is wrong.
Reported-by Coverity (CID: 166729)
Signed-off-by Bin Meng <[email protected]>

Reviewed-by Tom Rini <[email protected]>

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170902/017470b3/attachment.sig>

Tom Rini

2017-09-04 00:42 UTC #8 lore raw

PATCH 1/3 nvme: Fix wrong ndev->queues memset

In reply to Bin Meng

Quoted 6 lines · Bin Meng

memset() was given a sizeof(NVME_Q_NUM * sizeof(struct nvme_queue *) to clear, which is wrong.
Reported-by Coverity (CID: 166729)
Signed-off-by Bin Meng <[email protected]>
Reviewed-by Tom Rini <[email protected]>

Applied to u-boot/master, thanks!

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170903/d862bdbb/attachment.sig>