Coverity: rtw89_mac_resize_ple_rx_quota(): Integer handling issues
Hello!
This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20221102 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan
You're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits:
Tue Nov 1 11:26:13 2022 +0200
7a68ec3da79e ("wifi: rtw89: add function to adjust and restore PLE quota")
Coverity reported the following:
*** CID 1527095: Integer handling issues (SIGN_EXTENSION) /drivers/net/wireless/realtek/rtw89/mac.c: 1562 in rtw89_mac_resize_ple_rx_quota()
1556 rtw89_err(rtwdev, "[ERR]get_dle_mem_cfg\n"); 1557 return -EINVAL; 1558 }
1559
1560 min_cfg = cfg->ple_min_qt;
1561 max_cfg = cfg->ple_max_qt;
vvv CID 1527095: Integer handling issues (SIGN_EXTENSION)
vvv Suspicious implicit sign extension: "max_cfg->cma0_dma" with type "u16" (16 bits, unsigned) is promoted in "max_cfg->cma0_dma << 16" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "max_cfg->cma0_dma << 16" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
1562 SET_QUOTA(cma0_dma, PLE, 6);
1563 SET_QUOTA(cma1_dma, PLE, 7);
1564
1565 return 0; 1566 } 1567 #undef SET_QUOTA
If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first):
Addresses-Coverity-ID: 1527095 ("Integer handling issues")
Thanks for your attention!
Signature · 1 line
Coverity-bot
Quoted 28 lines
-----Original Message-----
From: coverity-bot <[email protected]>
Sent: Thursday, November 3, 2022 3:53 AM
To: Gary Chang <[email protected]>
Cc: Timlee <[email protected]>; Kalle Valo <[email protected]>; Ping-Ke Shih <[email protected]>; Gustavo A. R. Silva <[email protected]>; [email protected]; [email protected]
Subject: Coverity:rtw89_mac_resize_ple_rx_quota(): Integer handling issuesHello!
This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20221102 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scanYou're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits:
Tue Nov 1 11:26:13 2022 +0200
7a68ec3da79e("wifi: rtw89: add function to adjust and restore PLE quota")Coverity reported the following:
*** CID 1527095: Integer handling issues (
SIGN_EXTENSION) /drivers/net/wireless/realtek/rtw89/mac.c: 1562 inrtw89_mac_resize_ple_rx_quota()1556 rtw89_err(rtwdev, "[ERR]get_dle_mem_cfg\n"); 1557 return -EINVAL; 1558 }
Quoted 8 lines
1559
1560min_cfg=cfg->ple_min_qt;
1561max_cfg=cfg->ple_max_qt;
vvv CID 1527095: Integer handling issues (SIGN_EXTENSION)
vvv Suspicious implicit sign extension: "max_cfg->cma0_dma" with type "u16" (16 bits, unsigned) is
promoted in "max_cfg->cma0_dma<< 16" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "max_cfg->cma0_dma<< 16" is greater than0x7FFFFFFF, the upper bits of the result will all be 1.
Thanks for pointing this. I'll fix it.
Ping-Ke
Quoted 7 lines
1562
SET_QUOTA(cma0_dma, PLE, 6);
1563SET_QUOTA(cma1_dma, PLE, 7);
15641565 return 0; 1566 } 1567 #undef SET_QUOTA
Quoted 36 lines · Ping-Ke Shih
Quoted 27 lines
-----Original Message-----
From: coverity-bot <[email protected]>
Sent: Thursday, November 3, 2022 3:53 AM
To: Gary Chang <[email protected]>
Cc: Timlee <[email protected]>; Kalle Valo <[email protected]>; Ping-Ke Shih <[email protected]>; Gustavo A. R. Silva <[email protected]>; [email protected]; [email protected]
Subject: Coverity:rtw89_mac_resize_ple_rx_quota(): Integer handling issuesHello!
This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20221102 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scanYou're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits:
Tue Nov 1 11:26:13 2022 +0200
7a68ec3da79e("wifi: rtw89: add function to adjust and restore PLE quota")Coverity reported the following:
*** CID 1527095: Integer handling issues (
SIGN_EXTENSION) /drivers/net/wireless/realtek/rtw89/mac.c: 1562 inrtw89_mac_resize_ple_rx_quota()1556 rtw89_err(rtwdev, "[ERR]get_dle_mem_cfg\n"); 1557 return -EINVAL; 1558 }Quoted 8 lines
1559
1560min_cfg=cfg->ple_min_qt;
1561max_cfg=cfg->ple_max_qt;
vvv CID 1527095: Integer handling issues (SIGN_EXTENSION)
vvv Suspicious implicit sign extension: "max_cfg->cma0_dma" with type "u16" (16 bits, unsigned) is
promoted in "max_cfg->cma0_dma<< 16" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "max_cfg->cma0_dma<< 16" is greater than0x7FFFFFFF, the upper bits of the result will all be 1.
Quoted 1 line
Thanks for pointing this. I'll fix it.
Thanks Ping.
I noticed that linux-wireless list was missing in CC, would it possible for the bot to automatically add that to all wireless related reports? Adding it manually now.
Signature · 3 lines
https://patchwork.kernel.org/project/linux-wireless/list/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Quoted 3 lines · Kalle Valo
I noticed that linux-wireless list was missing in CC, would it possible for the bot to automatically add that to all wireless related reports? Adding it manually now.
Yes, good point. The tooling was looking at the commit's tags, rather than getting a get_maintainers.pl list. I'll add this logic.
Signature · 1 line
Kees Cook