| Message ID | 20181210113443.22796-1-yuehaibing@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [net-next] ieee802154: ca8210: remove a dead branch | expand |
From: YueHaibing <yuehaibing@huawei.com> Date: Mon, 10 Dec 2018 19:34:43 +0800 > Fix follwing gcc warning: > > drivers/net/ieee802154/ca8210.c:730:10: warning: > comparison is always false due to limited range of data type [-Wtype-limits] > > the variable 'len' is of type u8 and cannot greater than > CA8210_SPI_BUF_SIZE , which is 256. > > Signed-off-by: YueHaibing <yuehaibing@huawei.com> Then bug is the variable type here. We are reading a u8 from buf[], then adding 2, which can overflow. 'len' should be an unsigned int or similar.
On 2018/12/11 4:04, David Miller wrote: > From: YueHaibing <yuehaibing@huawei.com> > Date: Mon, 10 Dec 2018 19:34:43 +0800 > >> Fix follwing gcc warning: >> >> drivers/net/ieee802154/ca8210.c:730:10: warning: >> comparison is always false due to limited range of data type [-Wtype-limits] >> >> the variable 'len' is of type u8 and cannot greater than >> CA8210_SPI_BUF_SIZE , which is 256. >> >> Signed-off-by: YueHaibing <yuehaibing@huawei.com> > > Then bug is the variable type here. > > We are reading a u8 from buf[], then adding 2, which can overflow. > > 'len' should be an unsigned int or similar. Oh, Yes, will do it in v2. > > . >
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index 0ff5a40..0fe204f 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -727,14 +727,6 @@ static void ca8210_rx_done(struct cas_control *cas_ctl) buf = cas_ctl->tx_in_buf; len = buf[1] + 2; - if (len > CA8210_SPI_BUF_SIZE) { - dev_crit( - &priv->spi->dev, - "Received packet len (%d) erroneously long\n", - len - ); - goto finish; - } if (buf[0] & SPI_SYN) { if (priv->sync_command_response) {
Fix follwing gcc warning: drivers/net/ieee802154/ca8210.c:730:10: warning: comparison is always false due to limited range of data type [-Wtype-limits] the variable 'len' is of type u8 and cannot greater than CA8210_SPI_BUF_SIZE , which is 256. Signed-off-by: YueHaibing <yuehaibing@huawei.com> --- drivers/net/ieee802154/ca8210.c | 8 -------- 1 file changed, 8 deletions(-)