| Message ID | 20240925135106.2084111-1-g.ryurikov@securitycode.ru (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | r8169: Potential divizion by zero in rtl_set_coalesce() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply |
On Wed, Sep 25, 2024 at 04:51:06PM +0300, George Rurikov wrote: > Variable 'scale', whose possible value set allows a zero value in a check > at r8169_main.c:2014, is used as a denominator at r8169_main.c:2040 and > r8169_main.c:2042. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 2815b30535a0 ("r8169: merge scale for tx and rx irq coalescing") > Cc: stable@vger.kernel.org > Signed-off-by: George Rurikov <g.ryurikov@securitycode.ru> > --- > drivers/net/ethernet/realtek/r8169_main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c > index 45ac8befba29..b97e68cfcfad 100644 > --- a/drivers/net/ethernet/realtek/r8169_main.c > +++ b/drivers/net/ethernet/realtek/r8169_main.c > @@ -2011,7 +2011,7 @@ static int rtl_set_coalesce(struct net_device *dev, > > coal_usec_max = max(ec->rx_coalesce_usecs, ec->tx_coalesce_usecs); > scale = rtl_coalesce_choose_scale(tp, coal_usec_max, &cp01); > - if (scale < 0) > + if (scale <= 0) > return scale; Please think about this. Say scale is 0, and you return it. It appears the call has worked, but in fact it did nothing. I much prefer a division by 0, causing a splat, than the silent bug you just added. Also, please could you explain the code path which results in scale being 0. Andrew --- pw-bot: cr
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index 45ac8befba29..b97e68cfcfad 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -2011,7 +2011,7 @@ static int rtl_set_coalesce(struct net_device *dev, coal_usec_max = max(ec->rx_coalesce_usecs, ec->tx_coalesce_usecs); scale = rtl_coalesce_choose_scale(tp, coal_usec_max, &cp01); - if (scale < 0) + if (scale <= 0) return scale; /* Accept max_frames=1 we returned in rtl_get_coalesce. Accept it
Variable 'scale', whose possible value set allows a zero value in a check at r8169_main.c:2014, is used as a denominator at r8169_main.c:2040 and r8169_main.c:2042. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 2815b30535a0 ("r8169: merge scale for tx and rx irq coalescing") Cc: stable@vger.kernel.org Signed-off-by: George Rurikov <g.ryurikov@securitycode.ru> --- drivers/net/ethernet/realtek/r8169_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1 Заявление о конфиденциальности Данное электронное письмо и любые приложения к нему являются конфиденциальными и предназначены исключительно для адресата. Если Вы не являетесь адресатом данного письма, пожалуйста, уведомите немедленно отправителя, не раскрывайте содержание другим лицам, не используйте его в каких-либо целях, не храните и не копируйте информацию любым способом.