Re: [net-next 07/14] ixgbe: eliminate Smatch warnings in ixgbe_debugfs.c
flat view
From: Dan Carpenter <hidden>
Date: 2012-10-26 12:41:44
On Fri, Oct 26, 2012 at 04:58:15AM -0700, Jeff Kirsher wrote:
From: "joshua.a.hay@intel.com" <redacted> This patch replaces calls to copy_to_user, copy_from_user, and the associated logic, with calls to simple_read_from_buffer and simple_write_to_buffer respectively. This was done to eliminate warnings generated by the Smatch static analysis tool.
There were some bugs, it wasn't just about silencing warnings.
quoted hunk ↗ jump to hunk
+ buf = kasprintf(GFP_KERNEL, "%s: %s\n", + adapter->netdev->name, + ixgbe_dbg_reg_ops_buf); + if (!buf) + return -ENOMEM; + + if (count < strlen(buf)) return -ENOSPC;
You need a kfree(buf) here.
quoted hunk ↗ jump to hunk
- ixgbe_dbg_reg_ops_buf[count] = '\0'; + len = simple_write_to_buffer(ixgbe_dbg_reg_ops_buf, + sizeof(ixgbe_dbg_reg_ops_buf),
This should be "sizeof(ixgbe_dbg_reg_ops_buf) - 1" to leave space for the NUL terminator.
quoted hunk ↗ jump to hunk
+ ppos, + buffer, + count); + ixgbe_dbg_reg_ops_buf[len] = '\0';
simple_write_to_buffer() returns negative error codes so this could corrupt memory.
quoted hunk ↗ jump to hunk
+ buf = kasprintf(GFP_KERNEL, "%s: %s\n", + adapter->netdev->name, + ixgbe_dbg_netdev_ops_buf); + if (!buf) + return -ENOMEM; - *ppos = len; + if (count < strlen(buf)) + return -ENOSPC;
Missing kfree().
quoted hunk ↗ jump to hunk
- ixgbe_dbg_netdev_ops_buf[count] = '\0'; + len = simple_write_to_buffer(ixgbe_dbg_netdev_ops_buf, + sizeof(ixgbe_dbg_netdev_ops_buf), + ppos, + buffer, + count); + ixgbe_dbg_netdev_ops_buf[len] = '\0';
Same issues as before. regards, dan carpenter