integer overflow in i2o_block

integer overflow in i2o_block

[Meelis Roos]

Got this warning on 32-bit ppc, seems real? And it seems I2O 
subsystem has no maintainer (only DPT_I2O has one)?

  CC [M]  drivers/message/i2o/i2o_block.o
drivers/message/i2o/i2o_block.c: In function 'i2o_block_transfer':
drivers/message/i2o/i2o_block.c:837: warning: integer overflow in expression

The line in question is
msg->u.head[1] = cpu_to_le32(I2O_CMD_PRIVATE << 24 | HOST_TID << 12 | tid);
and I2O_CMD_PRIVATE is defined as 0xFF. This gets "0xFF0100 | tid" and 
fits into 32-bit unsigned but not into 32-bit signed integer properly.
Target value head[*] is defined as u32 so the claculation does not fit 
during computation? Should we mark the shiftable inputas as unsigned?

-- 
Meelis Roos (mroos@linux.ee)

RE: integer overflow in i2o_block

[Salyzyn, Mark]

I would change tid from an int to an unsigned instead, he is the culprit
that is promoting the unsigned to an signed.

Sincerely -- Mark Salyzyn

> -----Original Message-----
> From: linux-kernel-owner@vger.kernel.org 
> [mailto:linux-kernel-owner@vger.kernel.org] On Behalf Of Meelis Roos
> Sent: Thursday, July 26, 2007 4:30 PM
> To: Linux Kernel list
> Subject: integer overflow in i2o_block
> 
> 
> Got this warning on 32-bit ppc, seems real? And it seems I2O 
> subsystem has no maintainer (only DPT_I2O has one)?
> 
>   CC [M]  drivers/message/i2o/i2o_block.o
> drivers/message/i2o/i2o_block.c: In function 'i2o_block_transfer':
> drivers/message/i2o/i2o_block.c:837: warning: integer 
> overflow in expression
> 
> The line in question is
> msg->u.head[1] = cpu_to_le32(I2O_CMD_PRIVATE << 24 | HOST_TID 
> << 12 | tid);
> and I2O_CMD_PRIVATE is defined as 0xFF. This gets "0xFF0100 | 
> tid" and 
> fits into 32-bit unsigned but not into 32-bit signed integer properly.
> Target value head[*] is defined as u32 so the claculation 
> does not fit 
> during computation? Should we mark the shiftable inputas as unsigned?
> 
> -- 
> Meelis Roos (mroos@linux.ee)
> -
> To unsubscribe from this list: send the line "unsubscribe 
> linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

[PATCH] fix integer overflow warning in i2o_block

[Meelis Roos]

> I would change tid from an int to an unsigned instead, he is the culprit
> that is promoting the unsigned to an signed.

Thanks, this is the culprit.

> >   CC [M]  drivers/message/i2o/i2o_block.o
> > drivers/message/i2o/i2o_block.c: In function 'i2o_block_transfer':
> > drivers/message/i2o/i2o_block.c:837: warning: integer 
> > overflow in expression

The patch below changes local variable tid to u32 so the whole 
expression is of u32 type and fits well into u32 result. Compile tested 
only since I have currently no extra I2O hardware available for testing.

Signed-off-by: Meelis Roos <mroos@linux.ee>

diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index 5e1c99f..50b2c73 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -744,7 +744,7 @@ static int i2o_block_transfer(struct request *req)
 {
 	struct i2o_block_device *dev = req->rq_disk->private_data;
 	struct i2o_controller *c;
-	int tid = dev->i2o_dev->lct_data.tid;
+	u32 tid = dev->i2o_dev->lct_data.tid;
 	struct i2o_message *msg;
 	u32 *mptr;
 	struct i2o_block_request *ireq = req->special;

-- 
Meelis Roos (mroos@linux.ee)