[PATCH 00/38] Fixes related to incorrect usage of unsigned types

Hi,

This is set of independent patches. The only connection between
them is that they try to address problems spotted by proposed
coccinelle semantic patch unsigned_lesser_than_zero.cocci[1].

Semantic patch finds comparisons of types:
    unsigned < 0
    unsigned >= 0
The former is always false, the latter is always true.
Such comparisons are useless, so theoretically they could be
safely removed, but their presence quite often indicates bugs.

This patchset contains mainly real bug fixes(patches 01-25),
usually type fixes.

Patches 26-37 removes unnecessary checks. Semantic patch found
much more such places (more than 80), but since every case needs
some analysis I have decided to leave them for antoher patchset.

The last patch should be probably replaced with something better,
I guess it should be treated rather as bug report.

The patches are based on linux-next (20150918).

Patches were only compile tested, so please look at them carefully.

I have sent all patches to linux-kernel mailing list. Individual
patches + cover letter went also to apropriate addresses,
according to get_maintainers.pl script.

One more thing. To fullfill different maintaner/subsystem requirements
I have decided to prefix patch subjects with prefixes present in
last 10 commits for affected files. I am not sure if this is the
best solution, if there are any better solutions please let me know :)

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Regards
Andrzej


Andrzej Hajda (38):
  arm-cci: fix handling cpumask_any_but return value
  bus: arm-ccn: fix handling cpumask_any_but return value
  drm/i915: fix handling gen8_emit_flush_coherentl3_wa result
  IB/ehca: fix handling idr_alloc result
  staging: lustre: fix handling lustre_posix_acl_xattr_filter result
  tty: serial: lpc32xx_hs: fix handling platform_get_irq result
  usb: host: ehci-msm: fix handling platform_get_irq result
  openvswitch: fix handling result of ipv6_skip_exthdr
  selftests/timers: fix write return value handlng
  hwrng: fix handling platform_get_irq
  HSI: omap_ssi: fix handling ida_simple_get result
  HSI: omap_ssi_port: fix handling of_get_named_gpio result
  ARM: shmobile: apmu: correct type of CPU id
  clk: vt8500: fix sign of possible PLL values
  drm/layerscape: fix handling fsl_dcu_drm_plane_index result
  gpu: ipu-v3: fix div_ratio type
  isdn: hisax: fix frame calculation
  net/ibm/emac: fix type of phy_mode
  net: stmmac: fix type of entry variable
  net: brcm80211: fix range check
  mwifiex: fix comparison expression
  orinoco: fix checking for default value
  rndis_wlan: fix checking for default value
  rtc: opal: fix type of token
  staging: media: davinci_vpfe: fix ipipe_mode type
  staging: lustre: remove invalid check
  usbnet: remove invalid check
  video/omap: remove invalid check
  Input: touchscreen: atmel: remove invalid check
  leds: flash: remove invalid check
  leds: tca6507: remove invalid check
  fs/cachefiles: remove invalid checks
  mm/memblock.c: remove invalid check
  perf: remove invalid check
  ptrace: remove invalid check
  MIPS: remove invalid check
  zlib_deflate/deftree: change always true condition to 1
  drm/radeon: simplify boot level calculation

 arch/arm/mach-shmobile/platsmp-apmu.c               |  2 +-
 arch/mips/mm/sc-mips.c                              |  4 ++--
 arch/sh/kernel/ptrace_32.c                          |  3 +--
 arch/sh/kernel/ptrace_64.c                          |  4 ++--
 drivers/bus/arm-cci.c                               |  2 +-
 drivers/bus/arm-ccn.c                               |  2 +-
 drivers/char/hw_random/xgene-rng.c                  |  7 ++++---
 drivers/clk/clk-vt8500.c                            |  6 +++---
 drivers/gpu/drm/amd/amdgpu/kv_dpm.c                 | 11 +----------
 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c         |  3 ++-
 drivers/gpu/drm/i915/intel_lrc.c                    |  7 ++++---
 drivers/gpu/drm/radeon/kv_dpm.c                     | 11 +----------
 drivers/gpu/ipu-v3/ipu-csi.c                        |  2 +-
 drivers/hsi/controllers/omap_ssi.c                  |  7 +++----
 drivers/hsi/controllers/omap_ssi_port.c             |  8 ++++----
 drivers/input/touchscreen/atmel_mxt_ts.c            |  2 +-
 drivers/isdn/hisax/hfc4s8s_l1.c                     | 10 +++++-----
 drivers/leds/led-class-flash.c                      |  2 +-
 drivers/leds/leds-tca6507.c                         |  2 +-
 drivers/net/ethernet/ibm/emac/core.h                |  2 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c   |  2 +-
 drivers/net/usb/lan78xx.c                           |  5 -----
 drivers/net/usb/smsc75xx.c                          |  5 -----
 drivers/net/usb/smsc95xx.c                          |  5 -----
 drivers/net/wireless/brcm80211/brcmsmac/main.c      |  2 +-
 drivers/net/wireless/mwifiex/11n_rxreorder.c        |  4 ++--
 drivers/net/wireless/orinoco/cfg.c                  |  6 +++---
 drivers/net/wireless/rndis_wlan.c                   |  2 +-
 drivers/rtc/rtc-opal.c                              |  4 ++--
 drivers/staging/lustre/lustre/llite/xattr.c         |  7 ++++---
 drivers/staging/lustre/lustre/osc/lproc_osc.c       |  3 ---
 drivers/staging/media/davinci_vpfe/dm365_ipipe_hw.c |  2 +-
 drivers/staging/rdma/ehca/ehca_cq.c                 | 13 +++++++------
 drivers/tty/serial/lpc32xx_hs.c                     |  7 ++++---
 drivers/usb/host/ehci-msm.c                         |  6 +++---
 drivers/video/fbdev/omap/omapfb_main.c              |  5 -----
 fs/cachefiles/bind.c                                |  9 +++------
 fs/cachefiles/daemon.c                              |  6 +++---
 lib/zlib_deflate/deftree.c                          |  2 +-
 mm/memblock.c                                       |  2 +-
 net/openvswitch/conntrack.c                         |  2 +-
 tools/testing/selftests/timers/clocksource-switch.c |  2 +-
 42 files changed, 79 insertions(+), 119 deletions(-)

-- 
1.9.1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Difference of unsigned values is also unsigned so it does not make
sense to check its sign.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/isdn/hisax/hfc4s8s_l1.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/isdn/hisax/hfc4s8s_l1.c b/drivers/isdn/hisax/hfc4s8s_l1.c
index 0e5d673..9600cd7 100644
--- a/drivers/isdn/hisax/hfc4s8s_l1.c
+++ b/drivers/isdn/hisax/hfc4s8s_l1.c

@@ -646,14 +646,14 @@ rx_d_frame(struct hfc4s8s_l1 *l1p, int ech)
 
 		f1 = Read_hfc8_stable(l1p->hw, A_F1);
 		f2 = Read_hfc8(l1p->hw, A_F2);
-		df = f1 - f2;
-		if ((f1 - f2) < 0)
-			df = f1 - f2 + MAX_F_CNT + 1;
 
+		if (f1 < f2)
+			df = MAX_F_CNT + 1 + f1 - f2;
+		else
+			df = f1 - f2;
 
-		if (!df) {
+		if (!df)
 			return;	/* no complete frame in fifo */
-		}
 
 		z1 = Read_hfc16_stable(l1p->hw, A_Z1);
 		z2 = Read_hfc16(l1p->hw, A_Z2);

-- 
1.9.1

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:49 +0200

Difference of unsigned values is also unsigned so it does not make
sense to check its sign.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

To avoid underflows signed variables should be used in expression.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/net/wireless/mwifiex/11n_rxreorder.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 2906cd5..b3970a8 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c

@@ -615,10 +615,10 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
 	    ((end_win > start_win) && ((seq_num > end_win) ||
 				       (seq_num < start_win)))) {
 		end_win = seq_num;
-		if (((seq_num - win_size) + 1) >= 0)
+		if (((end_win - win_size) + 1) >= 0)
 			start_win = (end_win - win_size) + 1;
 		else
-			start_win = (MAX_TID_VALUE - (win_size - seq_num)) + 1;
+			start_win = (MAX_TID_VALUE - (win_size - end_win)) + 1;
 		mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win);
 	}
 

-- 
1.9.1

Hi Andrzej,

Acked-by: Amitkumar Karwar <redacted>

Regards,
Amitkumar

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:53 +0200

To avoid underflows signed variables should be used in expression.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

Thresholds uses -1 to indicate that default value should be used.
Since thresholds are unsigned sign checking makes no sense.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/net/wireless/orinoco/cfg.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/orinoco/cfg.c b/drivers/net/wireless/orinoco/cfg.c
index a9e94b6..0f6ea31 100644
--- a/drivers/net/wireless/orinoco/cfg.c
+++ b/drivers/net/wireless/orinoco/cfg.c

@@ -220,7 +220,7 @@ static int orinoco_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 	if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
 		/* Set fragmentation */
 		if (priv->has_mwo) {
-			if (wiphy->frag_threshold < 0)
+			if (wiphy->frag_threshold == -1)
 				frag_value = 0;
 			else {
 				printk(KERN_WARNING "%s: Fixed fragmentation "

@@ -230,7 +230,7 @@ static int orinoco_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 				frag_value = 1;
 			}
 		} else {
-			if (wiphy->frag_threshold < 0)
+			if (wiphy->frag_threshold == -1)
 				frag_value = 2346;
 			else if ((wiphy->frag_threshold < 257) ||
 				 (wiphy->frag_threshold > 2347))

@@ -252,7 +252,7 @@ static int orinoco_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 		 * the upper limit.
 		 */
 
-		if (wiphy->rts_threshold < 0)
+		if (wiphy->rts_threshold == -1)
 			rts_value = 2347;
 		else if (wiphy->rts_threshold > 2347)
 			err = -EINVAL;

-- 
1.9.1

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:54 +0200

Thresholds uses -1 to indicate that default value should be used.
Since thresholds are unsigned sign checking makes no sense.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

skb->len is always non-negative.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/net/usb/lan78xx.c  | 5 -----
 drivers/net/usb/smsc75xx.c | 5 -----
 drivers/net/usb/smsc95xx.c | 5 -----
 3 files changed, 15 deletions(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index a39518f..e0556dc 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c

@@ -2522,11 +2522,6 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb)
 			skb_pull(skb, align_count);
 	}
 
-	if (unlikely(skb->len < 0)) {
-		netdev_warn(dev->net, "invalid rx length<0 %d", skb->len);
-		return 0;
-	}
-
 	return 1;
 }
 

diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index d9e7892..30033db 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c

@@ -2185,11 +2185,6 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 			skb_pull(skb, align_count);
 	}
 
-	if (unlikely(skb->len < 0)) {
-		netdev_warn(dev->net, "invalid rx length<0 %d\n", skb->len);
-		return 0;
-	}
-
 	return 1;
 }
 

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 26423ad..66b3ab9 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c

@@ -1815,11 +1815,6 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 			skb_pull(skb, align_count);
 	}
 
-	if (unlikely(skb->len < 0)) {
-		netdev_warn(dev->net, "invalid rx length<0 %d\n", skb->len);
-		return 0;
-	}
-
 	return 1;
 }
 

-- 
1.9.1

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:59 +0200

skb->len is always non-negative.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

Thresholds uses -1 to indicate that default value should be used.
Since thresholds are unsigned sign checking makes no sense.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/net/wireless/rndis_wlan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 71a825c..a13d1f2 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c

@@ -1236,7 +1236,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
 
 	netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
 
-	if (rts_threshold < 0 || rts_threshold > 2347)
+	if (rts_threshold == -1 || rts_threshold > 2347)
 		rts_threshold = 2347;
 
 	tmp = cpu_to_le32(rts_threshold);

-- 
1.9.1

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:55 +0200

Thresholds uses -1 to indicate that default value should be used.
Since thresholds are unsigned sign checking makes no sense.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

Variable can store negative values.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 925f2f8..934143e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

@@ -1945,7 +1945,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct stmmac_priv *priv = netdev_priv(dev);
 	unsigned int txsize = priv->dma_tx_size;
-	unsigned int entry;
+	int entry;
 	int i, csum_insertion = 0, is_jumbo = 0;
 	int nfrags = skb_shinfo(skb)->nr_frags;
 	struct dma_desc *desc, *first;

-- 
1.9.1

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:51 +0200

Variable can store negative values.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

Unsigned minus constant is still unsigned so checking its sign makes no
sense.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/net/wireless/brcm80211/brcmsmac/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 9728be0..218cbc8 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c

@@ -4585,7 +4585,7 @@ static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
 		wlc_hw->machwcap_backup = wlc_hw->machwcap;
 
 		/* init tx fifo size */
-		WARN_ON((wlc_hw->corerev - XMTFIFOTBL_STARTREV) < 0 ||
+		WARN_ON(wlc_hw->corerev < XMTFIFOTBL_STARTREV ||
 			(wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
 				ARRAY_SIZE(xmtfifo_sz));
 		wlc_hw->xmtfifo_sz =

-- 
1.9.1

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:52 +0200

Unsigned minus constant is still unsigned so checking its sign makes no
sense.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

phy_mode can be negative.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 drivers/net/ethernet/ibm/emac/core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ibm/emac/core.h b/drivers/net/ethernet/ibm/emac/core.h
index 28df374..f379e47 100644
--- a/drivers/net/ethernet/ibm/emac/core.h
+++ b/drivers/net/ethernet/ibm/emac/core.h

@@ -181,7 +181,7 @@ struct emac_instance {
 	struct mal_commac		commac;
 
 	/* PHY infos */
-	u32				phy_mode;
+	int				phy_mode;
 	u32				phy_map;
 	u32				phy_address;
 	u32				phy_feat_exc;

-- 
1.9.1

From: Andrzej Hajda <redacted>
Date: Mon, 21 Sep 2015 15:33:50 +0200

phy_mode can be negative.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>

Applied.

The function can return negative value.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Signed-off-by: Andrzej Hajda <redacted>
---
 net/openvswitch/conntrack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 002a755..fde3391 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c

@@ -253,7 +253,7 @@ static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
 	const struct nf_conntrack_helper *helper;
 	const struct nf_conn_help *help;
 	enum ip_conntrack_info ctinfo;
-	unsigned int protoff;
+	int protoff;
 	struct nf_conn *ct;
 
 	ct = nf_ct_get(skb, &ctinfo);

-- 
1.9.1

_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev

On Mon, Sep 21, 2015 at 6:33 AM, Andrzej Hajda [off-list ref] wrote:

A patch is already pushed to the net tree to fix this issue.