Re: [PATCH] coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()

[Suzuki K Poulose <suzuki.poulose@xxxxxxx>]

Hi Dan

On 21/04/2023 11:42, Dan Carpenter wrote:
> This code generates a Smatch warning:
>
>      drivers/hwtracing/coresight/coresight-tmc-etr.c:947 tmc_etr_buf_insert_barrier_packet()
>      error: uninitialized symbol 'bufp'.
>
> The problem is that if tmc_sg_table_get_data() returns -EINVAL, then
> when we test if "len < CORESIGHT_BARRIER_PKT_SIZE", the negative "len"
> value is type promoted to a high unsigned long value which is greater
> than CORESIGHT_BARRIER_PKT_SIZE.  Fix this bug by adding an explicit
> check for error codes.
>
> Fixes: 75f4e3619fe2 ("coresight: tmc-etr: Add transparent buffer management")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
>   drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
> index 918d461fcf4a..eaa296ced167 100644
> --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
> +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
> @@ -942,7 +942,7 @@ tmc_etr_buf_insert_barrier_packet(struct etr_buf *etr_buf, u64 offset)
>   
>   	len = tmc_etr_buf_get_data(etr_buf, offset,
>   				   CORESIGHT_BARRIER_PKT_SIZE, &bufp);
> -	if (WARN_ON(len < CORESIGHT_BARRIER_PKT_SIZE))
> +	if (WARN_ON(len < 0 || len < CORESIGHT_BARRIER_PKT_SIZE))
>   		return -EINVAL;
>   	coresight_insert_barrier_packet(bufp);
>   	return offset + CORESIGHT_BARRIER_PKT_SIZE;


Thanks for the fix, I will send this as fixes at 6.4-rc1, as I have
already sent the PULL request for 6.4

Suzuki