re: fsdax: output address in dax_iomap_pfn() and rename it
Hi,
Static analysis with clang scan-build found a potential issue with the
following commit in linux-next today:
commit 1447ac26a96463a05ad9f5cfba7eef43d52913ef
Author: Shiyang Ruan
Date: Fri Jun 3 13:37:32 2022 +0800
fsdax: output address in dax_iomap_pfn() and rename it
The analysis is as follows:
static int dax_iomap_direct_access(const struct iomap *iomap, loff_t pos,
size_t size, void **kaddr, pfn_t *pfnp)
{
pgoff_t pgoff = dax_iomap_pgoff(iomap, pos);
int id, rc;
long length;
id = dax_read_lock();
length = dax_direct_access(iomap->dax_dev, pgoff, PHYS_PFN(size),
DAX_ACCESS, kaddr, pfnp);
if (length < 0) {
rc = length;
goto out;
}
if (!pfnp)
goto out_check_addr;
The above check jumps to out_check_addr, if kaddr is null then rc is not
set and a garbage uninitialized value for rc is returned on the out path.
rc = -EINVAL;
if (PFN_PHYS(length) < size)
goto out;
if (pfn_t_to_pfn(*pfnp) & (PHYS_PFN(size)-1))
goto out;
/* For larger pages we need devmap */
if (length > 1 && !pfn_t_devmap(*pfnp))
goto out;
rc = 0;
out_check_addr:
if (!kaddr)
goto out;
if (!*kaddr)
rc = -EFAULT;
out:
dax_read_unlock(id);
return rc;
}
Colin
[PATCH][next] selftests: add missing void in MREMAP_DONTUNMAP selftest function prototypes
From: Colin Ian King
There are a few function prototypes that are missing a void parameter,
fix this by adding it in.
Signed-off-by: Colin Ian King
---
tools/testing/selftests/vm/mremap_dontunmap.c | 10 +-
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/vm/mremap_dontunmap.c
b/tools/testing/selftests/vm/mremap_dontunmap.c
index f01dc4a85b0b..78baaf0e85d9 100644
--- a/tools/testing/selftests/vm/mremap_dontunmap.c
+++ b/tools/testing/selftests/vm/mremap_dontunmap.c
@@ -42,7 +42,7 @@ static void dump_maps(void)
// Try a simple operation for to "test" for kernel support this prevents
// reporting tests as failed when it's run on an older kernel.
-static int kernel_support_for_mremap_dontunmap()
+static int kernel_support_for_mremap_dontunmap(void)
{
int ret = 0;
unsigned long num_pages = 1;
@@ -95,7 +95,7 @@ static int check_region_contains_byte(void *addr, unsigned
long size, char byte)
// this test validates that MREMAP_DONTUNMAP moves the pagetables while leaving
// the source mapping mapped.
-static void mremap_dontunmap_simple()
+static void mremap_dontunmap_simple(void)
{
unsigned long num_pages = 5;
@@ -128,7 +128,7 @@ static void mremap_dontunmap_simple()
}
// This test validates that MREMAP_DONTUNMAP on a shared mapping works as
expected.
-static void mremap_dontunmap_simple_shmem()
+static void mremap_dontunmap_simple_shmem(void)
{
unsigned long num_pages = 5;
@@ -181,7 +181,7 @@ static void mremap_dontunmap_simple_shmem()
// This test validates MREMAP_DONTUNMAP will move page tables to a specific
// destination using MREMAP_FIXED, also while validating that the source
// remains intact.
-static void mremap_dontunmap_simple_fixed()
+static void mremap_dontunmap_simple_fixed(void)
{
unsigned long num_pages = 5;
@@ -226,7 +226,7 @@ static void mremap_dontunmap_simple_fixed()
// This test validates that we can MREMAP_DONTUNMAP for a portion of an
// existing mapping.
-static void mremap_dontunmap_partial_mapping()
+static void mremap_dontunmap_partial_mapping(void)
{
/*
* source mapping:
--
2.30.2
[PATCH] net: davinci_emac: Fix incorrect masking of tx and rx error channel
From: Colin Ian King
The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels)
are incorrect and always lead to a zero result. The mask values are
currently the incorrect post-right shifted values, fix this by setting
them to the currect values.
(I double checked these against the TMS320TCI6482 data sheet, section
5.30, page 127 to ensure I had the correct mask values for the TXERRCH
and RXERRCH fields in the MACSTATUS register).
Addresses-Coverity: ("Operands don't affect result")
Fixes: a6286ee630f6 ("net: Add TI DaVinci EMAC driver")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/ti/davinci_emac.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/ti/davinci_emac.c
b/drivers/net/ethernet/ti/davinci_emac.c
index 57450b174fc4..fb5eca688af9 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci
EMAC Linux v6.1";
/* EMAC mac_status register */
#define EMAC_MACSTATUS_TXERRCODE_MASK (0xF0)
#define EMAC_MACSTATUS_TXERRCODE_SHIFT (20)
-#define EMAC_MACSTATUS_TXERRCH_MASK(0x7)
+#define EMAC_MACSTATUS_TXERRCH_MASK(0x7)
#define EMAC_MACSTATUS_TXERRCH_SHIFT (16)
#define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000)
#define EMAC_MACSTATUS_RXERRCODE_SHIFT (12)
-#define EMAC_MACSTATUS_RXERRCH_MASK(0x7)
+#define EMAC_MACSTATUS_RXERRCH_MASK(0x700)
#define EMAC_MACSTATUS_RXERRCH_SHIFT (8)
/* EMAC RX register masks */
--
2.30.2
[PATCH] perf/x86: Fix integer overflow when left shifting an integer more than 32 bits
From: Colin Ian King
The 64 bit value read from MSR_ARCH_PERFMON_FIXED_CTR_CTRL is being
bit-wise masked with the value (0x03 << i*4). However, the shifted value
is evaluated using 32 bit arithmetic, so will overflow when i > 8.
Fix this by making 0x03 a ULL so that the shift is performed using
64 bit arithmetic.
Addresses-Coverity: ("Unintentional integer overflow")
Fixes: a5ebe0ba3dff ("perf/x86: Check all MSRs before passing hw check")
Signed-off-by: Colin Ian King
---
arch/x86/events/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index bafd93c54ffa..59c665c8c2e9 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -261,7 +261,7 @@ static bool check_hw_exists(void)
for (i = 0; i < x86_pmu.num_counters_fixed; i++) {
if (fixed_counter_disabled(i))
continue;
- if (val & (0x03 << i*4)) {
+ if (val & (0x03ULL << i*4)) {
bios_fail = 1;
val_fail = val;
reg_fail = reg;
--
2.30.2
[PATCH] ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
From: Colin Ian King
Currently when the call to usb_urb_ep_type_check fails (returning -EINVAL)
the error return path returns -ENOMEM via the exit label "error". Other
uses of the same error exit label set the err variable to -ENOMEM but this
is not being used. I believe the original intent was for the error exit
path to return the value in err rather than the hard coded -ENOMEM, so
return this rather than the hard coded -ENOMEM.
Addresses-Coverity: ("Unused value")
Fixes: 738d9edcfd44 ("ALSA: usb-audio: Add sanity checks for invalid EPs")
Signed-off-by: Colin Ian King
---
sound/usb/midi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 9efda4b06acb..a10ac75969a8 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1316,7 +1316,7 @@ static int snd_usbmidi_in_endpoint_create(struct
snd_usb_midi *umidi,
error:
snd_usbmidi_in_endpoint_delete(ep);
- return -ENOMEM;
+ return err;
}
/*
--
2.30.2
[PATCH][next] net: mana: remove redundant initialization of variable err
From: Colin Ian King
The variable err is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/microsoft/mana/hw_channel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c
b/drivers/net/ethernet/microsoft/mana/hw_channel.c
index 462bc577692a..0cf0322702ed 100644
--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
+++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c
@@ -55,7 +55,7 @@ static void mana_hwc_handle_resp(struct hw_channel_context
*hwc, u32 resp_len,
const struct gdma_resp_hdr *resp_msg)
{
struct hwc_caller_ctx *ctx;
- int err = -EPROTO;
+ int err;
if (!test_bit(resp_msg->response.hwc_msg_id,
hwc->inflight_msg_res.map)) {
--
2.30.2
[PATCH][next] platform/x86: intel_pmc_core: fix unsigned variable compared to less than zero
From: Colin Ian King
The check for ret < 0 is always false because ret is a (unsigned) size_t
and not a (signed) ssize_t, hence simple_write_to_buffer failures are
never detected. Fix this by making ret a ssize_t
Addresses-Coverity: ("Unsigned compared against 0")
Fixes: 8074a79fad2e ("platform/x86: intel_pmc_core: Add option to set/clear LPM
mode")
Signed-off-by: Colin Ian King
---
drivers/platform/x86/intel_pmc_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel_pmc_core.c
b/drivers/platform/x86/intel_pmc_core.c
index 3ae00ac85c75..d174aeb492e0 100644
--- a/drivers/platform/x86/intel_pmc_core.c
+++ b/drivers/platform/x86/intel_pmc_core.c
@@ -1360,7 +1360,7 @@ static ssize_t pmc_core_lpm_latch_mode_write(struct file
*file,
struct pmc_dev *pmcdev = s->private;
bool clear = false, c10 = false;
unsigned char buf[8];
- size_t ret;
+ ssize_t ret;
int idx, m, mode;
u32 reg;
--
2.30.2
[PATCH] usb: storage: datafab: remove redundant assignment of variable result
From: Colin Ian King
The variable result is being assigned with a value that is
never read, the assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/usb/storage/datafab.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/usb/storage/datafab.c b/drivers/usb/storage/datafab.c
index 588818483f4b..bcc4a2fad863 100644
--- a/drivers/usb/storage/datafab.c
+++ b/drivers/usb/storage/datafab.c
@@ -294,7 +294,6 @@ static int datafab_write_data(struct us_data *us,
if (reply[0] != 0x50 && reply[1] != 0) {
usb_stor_dbg(us, "Gah! write return code: %02x %02x\n",
reply[0], reply[1]);
- result = USB_STOR_TRANSPORT_ERROR;
goto leave;
}
--
2.30.2
[PATCH] usb: gadget: net2272: remove redundant initialization of status
From: Colin Ian King
The variable status is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed and move the
declaration of status to the scope where it is used.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/usb/gadget/udc/net2272.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
index 23a735641c3d..89f479b78d80 100644
--- a/drivers/usb/gadget/udc/net2272.c
+++ b/drivers/usb/gadget/udc/net2272.c
@@ -539,7 +539,6 @@ net2272_read_fifo(struct net2272_ep *ep, struct
net2272_request *req)
int count;
int tmp;
int cleanup = 0;
- int status = -1;
dev_vdbg(ep->dev->dev, "read_fifo %s actual %d len %d\n",
ep->ep.name, req->req.actual, req->req.length);
@@ -591,6 +590,8 @@ net2272_read_fifo(struct net2272_ep *ep, struct
net2272_request *req)
}
if (!list_empty(>queue)) {
+ int status;
+
req = list_entry(ep->queue.next,
struct net2272_request, queue);
status = net2272_kick_dma(ep, req);
--
2.30.2
[PATCH] tty: synclink_gt: remove redundant initialization of variable count
From: Colin Ian King
The variable count is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/tty/synclink_gt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 994618618466..5523cf7bd1c2 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -4958,7 +4958,7 @@ static int loopback_test(struct slgt_info *info)
#define TESTFRAMESIZE 20
unsigned long timeout;
- u16 count = TESTFRAMESIZE;
+ u16 count;
unsigned char buf[TESTFRAMESIZE];
int rc = -ENODEV;
unsigned long flags;
--
2.30.2
[PATCH] scsi: megaraid_mbox: remove redundant initialization of pointer mbox
From: Colin Ian King
The pointer mbox is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/scsi/megaraid/megaraid_mbox.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c
b/drivers/scsi/megaraid/megaraid_mbox.c
index 145fde302d7d..d0aa384adb76 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -3240,8 +3240,6 @@ megaraid_mbox_fire_sync_cmd(adapter_t *adapter)
int i;
uint32_t dword;
- mbox = (mbox_t *)raw_mbox;
-
memset((caddr_t)raw_mbox, 0, sizeof(mbox_t));
raw_mbox[0] = 0xFF;
--
2.30.2
[PATCH] scsi: lpfc: remove redundant assignment to pointer temp_hdr
From: Colin Ian King
The pointer tmp_hdr is being assigned a value that is never
read, the assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/scsi/lpfc/lpfc_sli.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 06ccc0157bd8..9ead564dd0c0 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -17936,7 +17936,6 @@ lpfc_fc_frame_add(struct lpfc_vport *vport, struct
hbq_dmabuf *dmabuf)
seq_dmabuf->time_stamp = jiffies;
lpfc_update_rcv_time_stamp(vport);
if (list_empty(_dmabuf->dbuf.list)) {
- temp_hdr = dmabuf->hbuf.virt;
list_add_tail(>dbuf.list, _dmabuf->dbuf.list);
return seq_dmabuf;
}
--
2.30.2
[PATCH][next][V2] wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
From: Colin Ian King
The size of the buffer than can be written to is currently incorrect, it is
always the size of the entire buffer even though the snprintf is writing
as position pos into the buffer. Fix this by setting the buffer size to be
the number of bytes left in the buffer, namely sizeof(buf) - pos.
Addresses-Coverity: ("Out-of-bounds access")
Fixes: 7b0e2c4f6be3 ("wlcore: fix overlapping snprintf arguments in debugfs")
Signed-off-by: Colin Ian King
Reviewed-by: Arnd Bergmann
---
V2: Fix patch subject
---
drivers/net/wireless/ti/wlcore/debugfs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h
b/drivers/net/wireless/ti/wlcore/debugfs.h
index 715edfa5f89f..a9e13e6d65c5 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.h
+++ b/drivers/net/wireless/ti/wlcore/debugfs.h
@@ -84,7 +84,7 @@ static ssize_t sub## _ ##name## _read(struct file *file,
\
wl1271_debugfs_update_stats(wl);\
\
for (i = 0; i < len && pos < sizeof(buf); i++) \
- pos += snprintf(buf + pos, sizeof(buf), \
+ pos += snprintf(buf + pos, sizeof(buf) - pos, \
"[%d] = %d\n", i, stats->sub.name[i]); \
\
return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \
--
2.30.2
[PATCH][next] wlcore: Fix buffer overrun by snprintf due to incorrect buffer size Content-Type: text/plain; charset="utf-8"
From: Colin Ian King
The size of the buffer than can be written to is currently incorrect, it is
always the size of the entire buffer even though the snprintf is writing
as position pos into the buffer. Fix this by setting the buffer size to be
the number of bytes left in the buffer, namely sizeof(buf) - pos.
Addresses-Coverity: ("Out-of-bounds access")
Fixes: 7b0e2c4f6be3 ("wlcore: fix overlapping snprintf arguments in debugfs")
Signed-off-by: Colin Ian King
---
drivers/net/wireless/ti/wlcore/debugfs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h
b/drivers/net/wireless/ti/wlcore/debugfs.h
index 715edfa5f89f..a9e13e6d65c5 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.h
+++ b/drivers/net/wireless/ti/wlcore/debugfs.h
@@ -84,7 +84,7 @@ static ssize_t sub## _ ##name## _read(struct file *file,
\
wl1271_debugfs_update_stats(wl);\
\
for (i = 0; i < len && pos < sizeof(buf); i++) \
- pos += snprintf(buf + pos, sizeof(buf), \
+ pos += snprintf(buf + pos, sizeof(buf) - pos, \
"[%d] = %d\n", i, stats->sub.name[i]); \
\
return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \
--
2.30.2
[PATCH][next] mt76: mt7615: Fix a dereference of pointer sta before it is null checked
From: Colin Ian King
Currently the assignment of idx dereferences pointer sta before
sta is null checked, leading to a potential null pointer dereference.
Fix this by assigning idx when it is required after the null check on
pointer sta.
Addresses-Coverity: ("Dereference before null check")
Fixes: a4a5a430b076 ("mt76: mt7615: fix TSF configuration")
Signed-off-by: Colin Ian King
---
drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
index 4a370b9f7a17..f8d3673c2cae 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
@@ -67,7 +67,7 @@ static int mt7663_usb_sdio_set_rates(struct mt7615_dev *dev,
struct mt7615_rate_desc *rate = >rate;
struct mt7615_sta *sta = wrd->sta;
u32 w5, w27, addr, val;
- u16 idx = sta->vif->mt76.omac_idx;
+ u16 idx;
lockdep_assert_held(>mt76.mutex);
@@ -119,6 +119,7 @@ static int mt7663_usb_sdio_set_rates(struct mt7615_dev *dev,
sta->rate_probe = sta->rateset[rate->rateset].probe_rate.idx != -1;
+ idx = sta->vif->mt76.omac_idx;
idx = idx > HW_BSSID_MAX ? HW_BSSID_0 : idx;
addr = idx > 1 ? MT_LPON_TCR2(idx): MT_LPON_TCR0(idx);
--
2.30.2
[PATCH][next] bcache: Set error return err to -ENOMEM on allocation failure
From: Colin Ian King
Currently when ns fails to be allocated the error return path returns
an uninitialized return code in variable 'err'. Fix this by setting
err to -ENOMEM.
Addresses-Coverity: ("Uninitialized scalar variable")
Fixes: 688330711e9a ("bcache: initialize the nvm pages allocator")
Signed-off-by: Colin Ian King
---
drivers/md/bcache/nvm-pages.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/bcache/nvm-pages.c b/drivers/md/bcache/nvm-pages.c
index 08cd45e90481..2e124d546099 100644
--- a/drivers/md/bcache/nvm-pages.c
+++ b/drivers/md/bcache/nvm-pages.c
@@ -584,6 +584,7 @@ struct bch_nvm_namespace *bch_register_namespace(const char
*dev_path)
return ERR_PTR(PTR_ERR(bdev));
}
+ err = -ENOMEM;
ns = kzalloc(sizeof(struct bch_nvm_namespace), GFP_KERNEL);
if (!ns)
goto bdput;
--
2.30.2
[PATCH] iommu: remove redundant assignment to variable agaw
From: Colin Ian King
The variable agaw is initialized with a value that is never
read and it is being updated later with a new value as a
counter in a for-loop. The initialization is redundant and
can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/iommu/intel/iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 0e04d450c38a..171dd4844ab2 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -564,7 +564,7 @@ static inline int domain_pfn_supported(struct dmar_domain
*domain,
static int __iommu_calculate_agaw(struct intel_iommu *iommu, int max_gaw)
{
unsigned long sagaw;
- int agaw = -1;
+ int agaw;
sagaw = cap_sagaw(iommu->cap);
for (agaw = width_to_agaw(max_gaw);
--
2.30.2
[PATCH] PM / wakeup: remove redundant assignment to variable retval
From: Colin Ian King
The variable retval is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/base/power/wakeup_stats.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/power/wakeup_stats.c
b/drivers/base/power/wakeup_stats.c
index 5ade7539ac02..924fac493c4f 100644
--- a/drivers/base/power/wakeup_stats.c
+++ b/drivers/base/power/wakeup_stats.c
@@ -137,7 +137,7 @@ static struct device *wakeup_source_device_create(struct
device *parent,
struct wakeup_source *ws)
{
struct device *dev = NULL;
- int retval = -ENODEV;
+ int retval;
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
if (!dev) {
--
2.30.2
[PATCH] drm/amdgpu/pm: use linux/processor.h instead of asm/processor.h
From: Colin Ian King
Checkpatch reported that linux/processor.h should be included instead
of the asm variant. Fix this to clean up the warning.
Signed-off-by: Colin Ian King
---
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index 204e34549013..6842dd483c2a 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -33,7 +33,7 @@
#include
#include
#include
-#include
+#include
#include "hwmgr.h"
static const struct cg_flag_name clocks[] = {
--
2.30.2
[PATCH] mac80211: minstrel_ht: remove extraneous indentation on if statement
From: Colin Ian King The increment of idx is indented one level too deeply, clean up the code by removing the extraneous tab. Signed-off-by: Colin Ian King --- net/mac80211/rc80211_minstrel_ht.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c index f21c85eb906a..6487b05da6fa 100644 --- a/net/mac80211/rc80211_minstrel_ht.c +++ b/net/mac80211/rc80211_minstrel_ht.c @@ -370,7 +370,7 @@ minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi, /* short preamble */ if ((mi->supported[group] & BIT(idx + 4)) && (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)) - idx += 4; + idx += 4; goto out; } -- 2.30.2
[PATCH] scsi: 3w-9xxx: Move * operator to clean up code style warning
From: Colin Ian King
Checkpatch is warning that char* text sould be char *text to match
the coding style. Fix this.
Signed-off-by: Colin Ian King
---
drivers/scsi/3w-9xxx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
index d3f479324527..30109ae96ce5 100644
--- a/drivers/scsi/3w-9xxx.h
+++ b/drivers/scsi/3w-9xxx.h
@@ -50,7 +50,7 @@
/* AEN string type */
typedef struct TAG_twa_message_type {
unsigned int code;
- char* text;
+ char *text;
} twa_message_type;
/* AEN strings */
--
2.30.2
[PATCH] sched/core: Add in additional const on preempt_modes array declaration
From: Colin Ian King
Checkpatch warnings that there is a missing const, fix this by adding it.
Clean us up warning:
"WARNING: static const char * array should probably be static
const char * const"
Signed-off-by: Colin Ian King
---
kernel/sched/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 42c06fccade5..beaa6263f4c3 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5472,7 +5472,7 @@ static ssize_t sched_dynamic_write(struct file *filp,
const char __user *ubuf,
static int sched_dynamic_show(struct seq_file *m, void *v)
{
- static const char * preempt_modes[] = {
+ static const char * const preempt_modes[] = {
"none", "voluntary", "full"
};
int i;
--
2.30.2
[PATCH] um: Fix inline void order in function declaration
From: Colin Ian King
The inline keyword should be between storage class and type. Fix
this by swapping void inline to inline void.
Signed-off-by: Colin Ian King
---
arch/x86/um/shared/sysdep/stub_32.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/um/shared/sysdep/stub_32.h
b/arch/x86/um/shared/sysdep/stub_32.h
index c3891c1ada26..b95db9daf0e8 100644
--- a/arch/x86/um/shared/sysdep/stub_32.h
+++ b/arch/x86/um/shared/sysdep/stub_32.h
@@ -77,7 +77,7 @@ static inline void trap_myself(void)
__asm("int3");
}
-static void inline remap_stack_and_trap(void)
+static inline void remap_stack_and_trap(void)
{
__asm__ volatile (
"movl %%esp,%%ebx ;"
--
2.30.2
[PATCH] ACPI: APEI: remove redundant assignment to variable rc
From: Colin Ian King
The variable rc is being assigned a value that is never read,
the assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/acpi/apei/einj.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
index 133156759551..328e8aeece6c 100644
--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -725,7 +725,6 @@ static int __init einj_init(void)
goto err_release;
}
- rc = -ENOMEM;
einj_param = einj_get_parameter_address();
if ((param_extension || acpi5) && einj_param) {
debugfs_create_x32("flags", S_IRUSR | S_IWUSR, einj_debug_dir,
--
2.30.2
[PATCH] partitions/ldm: remove redundant assignment to variable r_index
From: Colin Ian King
The variable r_index is being assigned a value that is never read,
the assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
block/partitions/ldm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
index d333786b5c7e..b40c0ac9022c 100644
--- a/block/partitions/ldm.c
+++ b/block/partitions/ldm.c
@@ -964,7 +964,6 @@ static bool ldm_parse_prt3(const u8 *buffer, int buflen,
struct vblk *vb)
}
len = r_index;
} else {
- r_index = 0;
len = r_diskid;
}
if (len < 0) {
--
2.30.2
[PATCH] floppy: remove redundant assignment to variable st
From: Colin Ian King
The variable st is being assigned a value that is never read and
it is being updated later with a new value. The initialization is
redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
arch/x86/include/asm/floppy.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/x86/include/asm/floppy.h b/arch/x86/include/asm/floppy.h
index d43717b423cb..6ec3fc969ad5 100644
--- a/arch/x86/include/asm/floppy.h
+++ b/arch/x86/include/asm/floppy.h
@@ -74,7 +74,6 @@ static irqreturn_t floppy_hardint(int irq, void *dev_id)
int lcount;
char *lptr;
- st = 1;
for (lcount = virtual_dma_count, lptr = virtual_dma_addr;
lcount; lcount--, lptr++) {
st = inb(virtual_dma_port + FD_STATUS);
--
2.30.2
[PATCH][next] can: etas_es58x: Fix a couple of spelling mistakes
From: Colin Ian King There are spelling mistakes in netdev_dbg and netdev_dbg messages, fix these. Signed-off-by: Colin Ian King --- drivers/net/can/usb/etas_es58x/es58x_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index 57e5f94468e9..8e9102482c52 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -688,7 +688,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error, case ES58X_ERR_PROT_STUFF: if (net_ratelimit()) - netdev_dbg(netdev, "Error BITSUFF\n"); + netdev_dbg(netdev, "Error BITSTUFF\n"); if (cf) cf->data[2] |= CAN_ERR_PROT_STUFF; break; @@ -1015,7 +1015,7 @@ int es58x_rx_cmd_ret_u32(struct net_device *netdev, int ret; netdev_warn(netdev, - "%s: channel is already opened, closing and re-openning it to reflect new configuration\n", + "%s: channel is already opened, closing and re-opening it to reflect new configuration\n", ret_desc); ret = ops->disable_channel(es58x_priv(netdev)); if (ret) -- 2.30.2
[PATCH] dmaengine: idxd: Fix potential null dereference on pointer status
From: Colin Ian King
There are calls to idxd_cmd_exec that pass a null status pointer however
a recent commit has added an assignment to *status that can end up
with a null pointer dereference. The function expects a null status
pointer sometimes as there is a later assignment to *status where
status is first null checked. Fix the issue by null checking status
before making the assignment.
Addresses-Coverity: ("Explicit null dereferenced")
Fixes: 89e3becd8f82 ("dmaengine: idxd: check device state before issue command")
Signed-off-by: Colin Ian King
---
drivers/dma/idxd/device.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index 31c819544a22..78d2dc5e9bd8 100644
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -451,7 +451,8 @@ static void idxd_cmd_exec(struct idxd_device *idxd, int
cmd_code, u32 operand,
if (idxd_device_is_halted(idxd)) {
dev_warn(>pdev->dev, "Device is HALTED!\n");
- *status = IDXD_CMDSTS_HW_ERR;
+ if (status)
+ *status = IDXD_CMDSTS_HW_ERR;
return;
}
--
2.30.2
[PATCH][next] can: etas_es58x: Fix potential null pointer dereference on pointer cf
From: Colin Ian King
The pointer cf is being null checked earlier in the code, however the
update of the rx_bytes statistics is dereferencing cf without null
checking cf. Fix this by moving the statement into the following code
block that has a null cf check.
Addresses-Coverity: ("Dereference after null check")
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB
interfaces")
Signed-off-by: Colin Ian King
---
drivers/net/can/usb/etas_es58x/es58x_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c
b/drivers/net/can/usb/etas_es58x/es58x_core.c
index 7222b3b6ca46..5198e1d6b6ad 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -856,9 +856,10 @@ int es58x_rx_err_msg(struct net_device *netdev, enum
es58x_err error,
* consistency.
*/
netdev->stats.rx_packets++;
- netdev->stats.rx_bytes += cf->can_dlc;
if (cf) {
+ netdev->stats.rx_bytes += cf->can_dlc;
+
if (cf->data[1])
cf->can_id |= CAN_ERR_CRTL;
if (cf->data[2] || cf->data[3]) {
--
2.30.2
[PATCH][next] can: etas_es58x: Fix missing null check on netdev pointer
From: Colin Ian King
There is an assignment to *netdev that is can potentially be null but the
null check is checking netdev and not *netdev as intended. Fix this by
adding in the missing * operator.
Addresses-Coverity: ("Dereference before null check")
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB
interfaces")
Signed-off-by: Colin Ian King
---
drivers/net/can/usb/etas_es58x/es58x_core.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.h
b/drivers/net/can/usb/etas_es58x/es58x_core.h
index 5f4e7dc5be35..fcf219e727bf 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.h
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.h
@@ -625,7 +625,7 @@ static inline int es58x_get_netdev(struct es58x_device
*es58x_dev,
return -ECHRNG;
*netdev = es58x_dev->netdev[channel_idx];
- if (!netdev || !netif_device_present(*netdev))
+ if (!*netdev || !netif_device_present(*netdev))
return -ENODEV;
return 0;
--
2.30.2
[PATCH][next] net: stmmac: replace redundant comparison with true
From: Colin Ian King
The comparison of the u32 variable queue with <= zero is always true
since an unsigned can never be negative. Replace the conditional
check with the boolean true to simplify the code. The while loop
will terminate because of the zero check on queue before queue is
decremented.
Addresses-Coverity: ("Unsigned compared against 0")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e3e22200a4fd..6e5b4c4b375c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1673,7 +1673,7 @@ static void stmmac_reinit_rx_buffers(struct stmmac_priv
*priv)
return;
err_reinit_rx_buffers:
- while (queue >= 0) {
+ while (true) {
dma_free_rx_skbufs(priv, queue);
if (queue == 0)
@@ -1781,7 +1781,7 @@ static int init_dma_rx_desc_rings(struct net_device *dev,
gfp_t flags)
return 0;
err_init_rx_buffers:
- while (queue >= 0) {
+ while (true) {
struct stmmac_rx_queue *rx_q = >rx_queue[queue];
if (rx_q->xsk_pool)
--
2.30.2
[PATCH][next] vdpa/mlx5: Fix resource leak of mgtdev due to incorrect kfree
From: Colin Ian King
Static analysis is reporting a memory leak on mgtdev, it appears
that the wrong object is being kfree'd. Fix this by kfree'ing
mgtdev rather than mdev.
Addresses-Coverity: ("Resource leak")
Fixes: c8a2d4c73e70 ("vdpa/mlx5: Enable user to add/delete vdpa device")
Signed-off-by: Colin Ian King
---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c
b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index 10c5fef3c020..25533db01f5f 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -2089,7 +2089,7 @@ static int mlx5v_probe(struct auxiliary_device *adev,
return 0;
reg_err:
- kfree(mdev);
+ kfree(mgtdev);
return err;
}
--
2.30.2
[PATCH][next] habanalabs/gaudi: Fix uninitialized return code rc when read size is zero
From: Colin Ian King
In the case where size is zero the while loop never assigns rc and the
return value is uninitialized. Fix this by initializing rc to zero.
Addresses-Coverity: ("Uninitialized scalar variable")
Fixes: 639781dcab82 ("habanalabs/gaudi: add debugfs to DMA from the device")
Signed-off-by: Colin Ian King
---
drivers/misc/habanalabs/gaudi/gaudi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c
b/drivers/misc/habanalabs/gaudi/gaudi.c
index 8730b691ec61..b751652f80a8 100644
--- a/drivers/misc/habanalabs/gaudi/gaudi.c
+++ b/drivers/misc/habanalabs/gaudi/gaudi.c
@@ -6252,7 +6252,7 @@ static int gaudi_debugfs_read_dma(struct hl_device *hdev,
u64 addr, u32 size,
dma_addr_t dma_addr;
void *kernel_addr;
bool is_eng_idle;
- int rc, dma_id;
+ int rc = 0, dma_id;
kernel_addr = hdev->asic_funcs->asic_dma_alloc_coherent(
hdev, SZ_2M,
--
2.30.2
[PATCH][next] KEYS: trusted: Fix missing null return from kzalloc call
From: Colin Ian King
The kzalloc call can return null with the GFP_KERNEL flag so
add a null check and exit via a new error exit label. Use the
same exit error label for another error path too.
Addresses-Coverity: ("Dereference null return value")
Fixes: 830027e2cb55 ("KEYS: trusted: Add generic trusted keys framework")
Signed-off-by: Colin Ian King
---
security/keys/trusted-keys/trusted_core.c | 6 --
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/security/keys/trusted-keys/trusted_core.c
b/security/keys/trusted-keys/trusted_core.c
index ec3a066a4b42..90774793f0b1 100644
--- a/security/keys/trusted-keys/trusted_core.c
+++ b/security/keys/trusted-keys/trusted_core.c
@@ -116,11 +116,13 @@ static struct trusted_key_payload
*trusted_payload_alloc(struct key *key)
ret = key_payload_reserve(key, sizeof(*p));
if (ret < 0)
- return p;
+ goto err;
p = kzalloc(sizeof(*p), GFP_KERNEL);
+ if (!p)
+ goto err;
p->migratable = migratable;
-
+err:
return p;
}
--
2.30.2
[PATCH][next] Bluetooth: virtio_bt: add missing null pointer check on alloc_skb call return
From: Colin Ian King
The call to alloc_skb with the GFP_KERNEL flag can return a null sk_buff
pointer, so add a null check to avoid any null pointer deference issues.
Addresses-Coverity: ("Dereference null return value")
Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Colin Ian King
---
drivers/bluetooth/virtio_bt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index c804db7e90f8..5f82574236c0 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -34,6 +34,8 @@ static int virtbt_add_inbuf(struct virtio_bluetooth *vbt)
int err;
skb = alloc_skb(1000, GFP_KERNEL);
+ if (!skb)
+ return -ENOMEM;
sg_init_one(sg, skb->data, 1000);
err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
--
2.30.2
[PATCH][next] net: hns3: Fix potential null pointer defererence of null ae_dev
From: Colin Ian King
The reset_prepare and reset_done calls have a null pointer check
on ae_dev however ae_dev is being dereferenced via the call to
ns3_is_phys_func with the ae->pdev argument. Fix this by performing
a null pointer check on ae_dev and hence short-circuiting the
dereference to ae_dev on the call to ns3_is_phys_func.
Addresses-Coverity: ("Dereference before null check")
Fixes: 715c58e94f0d ("net: hns3: add suspend and resume pm_ops")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 25afe5a3348c..c21dd11baed9 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2369,9 +2369,9 @@ static int __maybe_unused hns3_suspend(struct device *dev)
{
struct hnae3_ae_dev *ae_dev = dev_get_drvdata(dev);
- if (hns3_is_phys_func(ae_dev->pdev)) {
+ if (ae_dev && hns3_is_phys_func(ae_dev->pdev)) {
dev_info(dev, "Begin to suspend.\n");
- if (ae_dev && ae_dev->ops && ae_dev->ops->reset_prepare)
+ if (ae_dev->ops && ae_dev->ops->reset_prepare)
ae_dev->ops->reset_prepare(ae_dev, HNAE3_FUNC_RESET);
}
@@ -2382,9 +2382,9 @@ static int __maybe_unused hns3_resume(struct device *dev)
{
struct hnae3_ae_dev *ae_dev = dev_get_drvdata(dev);
- if (hns3_is_phys_func(ae_dev->pdev)) {
+ if (ae_dev && hns3_is_phys_func(ae_dev->pdev)) {
dev_info(dev, "Begin to resume.\n");
- if (ae_dev && ae_dev->ops && ae_dev->ops->reset_done)
+ if (ae_dev->ops && ae_dev->ops->reset_done)
ae_dev->ops->reset_done(ae_dev);
}
--
2.30.2
[PATCH] xfs: fix return of uninitialized value in variable error
From: Colin Ian King
A previous commit removed a call to xfs_attr3_leaf_read that
assigned an error return code to variable error. We now have
a few early error return paths to label 'out' that return
error if error is set; however error now is uninitialized
so potentially garbage is being returned. Fix this by setting
error to zero to restore the original behaviour where error
was zero at the label 'restart'.
Addresses-Coverity: ("Uninitialized scalar variable")
Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines")
Signed-off-by: Colin Ian King
---
fs/xfs/libxfs/xfs_attr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index 472b3039eabb..902e5f7e6642 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -928,6 +928,7 @@ xfs_attr_node_addname(
* Search to see if name already exists, and get back a pointer
* to where it should go.
*/
+ error = 0;
retval = xfs_attr_node_hasname(args, );
if (retval != -ENOATTR && retval != -EEXIST)
goto out;
--
2.30.2
[PATCH] net: thunderx: Fix unintentional sign extension issue
From: Colin Ian King
The shifting of the u8 integers rq->caching by 26 bits to
the left will be promoted to a 32 bit signed int and then
sign-extended to a u64. In the event that rq->caching is
greater than 0x1f then all then all the upper 32 bits of
the u64 end up as also being set because of the int
sign-extension. Fix this by casting the u8 values to a
u64 before the 26 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network
controller")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index f782e6af45e9..50bbe79fb93d 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -776,7 +776,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic,
struct queue_set *qs,
mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG;
mbx.rq.qs_num = qs->vnic_id;
mbx.rq.rq_num = qidx;
- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) |
+ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) |
(rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) |
(rq->cont_qs_rbdr_idx << 8) |
(rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx);
--
2.30.2
[PATCH] cxgb4: Fix unintentional sign extension issues
From: Colin Ian King
The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to
the left will be promoted to a 32 bit signed int and then
sign-extended to a u64. In the event that the top bit of the u8
is set then all then all the upper 32 bits of the u64 end up as
also being set because of the sign-extension. Fix this by
casting the u8 values to a u64 before the 24 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
Fixes: 12b276fbf6e0 ("cxgb4: add support to create hash filters")
Signed-off-by: Colin Ian King
---
.../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 22 +--
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
index b1cae5a19839..2f70f02207b2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
@@ -174,31 +174,31 @@ static void set_nat_params(struct adapter *adap, struct
filter_entry *f,
WORD_MASK, f->fs.nat_lip[15] |
f->fs.nat_lip[14] << 8 |
f->fs.nat_lip[13] << 16 |
- f->fs.nat_lip[12] << 24, 1);
+ (u64)f->fs.nat_lip[12] << 24, 1);
set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 1,
WORD_MASK, f->fs.nat_lip[11] |
f->fs.nat_lip[10] << 8 |
f->fs.nat_lip[9] << 16 |
- f->fs.nat_lip[8] << 24, 1);
+ (u64)f->fs.nat_lip[8] << 24, 1);
set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 2,
WORD_MASK, f->fs.nat_lip[7] |
f->fs.nat_lip[6] << 8 |
f->fs.nat_lip[5] << 16 |
- f->fs.nat_lip[4] << 24, 1);
+ (u64)f->fs.nat_lip[4] << 24, 1);
set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 3,
WORD_MASK, f->fs.nat_lip[3] |
f->fs.nat_lip[2] << 8 |
f->fs.nat_lip[1] << 16 |
- f->fs.nat_lip[0] << 24, 1);
+ (u64)f->fs.nat_lip[0] << 24, 1);
} else {
set_tcb_field(adap, f, tid, TCB_RX_FRAG3_LEN_RAW_W,
WORD_MASK, f->fs.nat_lip[3] |
f->fs.nat_lip[2] << 8 |
f->fs.nat_lip[1] << 16 |
- f->fs.nat_lip[0] << 24, 1);
+ (u64)f->fs.nat_lip[0] << 25, 1);
}
}
@@ -208,25 +208,25 @@ static void set_nat_params(struct adapter *adap, struct
filter_entry *f,
WORD_MASK, f->fs.nat_fip[15] |
f->fs.nat_fip[14] << 8 |
f->fs.nat_fip[13] << 16 |
- f->fs.nat_fip[12] << 24, 1);
+ (u64)f->fs.nat_fip[12] << 24, 1);
set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 1,
WORD_MASK, f->fs.nat_fip[11] |
f->fs.nat_fip[10] << 8 |
f->fs.nat_fip[9] << 16 |
- f->fs.nat_fip[8] << 24, 1);
+ (u64)f->fs.nat_fip[8] << 24, 1);
set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 2,
WORD_MASK, f->fs.nat_fip[7] |
f->fs.nat_fip[6] << 8 |
f->fs.nat_fip[5] << 16 |
- f->fs.nat_fip[4] << 24, 1);
+ (u64)f->fs.nat_fip[4] << 24, 1);
set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 3,
WORD_MASK, f->fs.nat_fip[3] |
f->fs.nat_fip[2] << 8 |
f->fs.nat_fip[1] << 16 |
- f->fs.nat_fip[0] << 24, 1);
+ (u64)f->fs.nat_fip[0] << 24, 1);
} else {
set_tcb_field(adap, f, tid,
@@ -234,13 +234,13 @@ static void set_nat_params(struct adapter *adap, struct
filter_entry *f,
WORD_MASK, f->fs.nat_fip[3] |
[PATCH] media: s2255drv: remove redundant assignment to variable field
From: Colin Ian King
The variable 'field' is being assigned a value this is never read,
it is being updated in all the following if/else combinations. The
assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/media/usb/s2255/s2255drv.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/media/usb/s2255/s2255drv.c
b/drivers/media/usb/s2255/s2255drv.c
index 4af55e2478be..3b0e4ed75d99 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -767,8 +767,6 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void
*priv,
if (fmt == NULL)
return -EINVAL;
- field = f->fmt.pix.field;
-
dprintk(vc->dev, 50, "%s NTSC: %d suggested width: %d, height: %d\n",
__func__, is_ntsc, f->fmt.pix.width, f->fmt.pix.height);
if (is_ntsc) {
--
2.30.2
[PATCH][V2] clk: uniphier: Fix potential infinite loop
From: Colin Ian King
The for-loop iterates with a u8 loop counter i and compares this
with the loop upper limit of num_parents that is an int type.
There is a potential infinite loop if num_parents is larger than
the u8 loop counter. Fix this by making the loop counter the same
type as num_parents. Also make num_parents an unsigned int to
match the return type of the call to clk_hw_get_num_parents.
Addresses-Coverity: ("Infinite loop")
Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clock
driver")
Signed-off-by: Colin Ian King
---
V2: Make num_parents an unsigned int to match return type of
clk_hw_get_num_parents().
---
drivers/clk/uniphier/clk-uniphier-mux.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c
b/drivers/clk/uniphier/clk-uniphier-mux.c
index 462c84321b2d..1998e9d4cfc0 100644
--- a/drivers/clk/uniphier/clk-uniphier-mux.c
+++ b/drivers/clk/uniphier/clk-uniphier-mux.c
@@ -31,10 +31,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw,
u8 index)
static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
{
struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw);
- int num_parents = clk_hw_get_num_parents(hw);
+ unsigned int num_parents = clk_hw_get_num_parents(hw);
int ret;
unsigned int val;
- u8 i;
+ unsigned int i;
ret = regmap_read(mux->regmap, mux->reg, );
if (ret)
--
2.30.2
[PATCH][V2] clk: uniphier: Fix potential infinite loop
From: Colin Ian King
The for-loop iterates with a u8 loop counter i and compares this
with the loop upper limit of num_parents that is an int type.
There is a potential infinite loop if num_parents is larger than
the u8 loop counter. Fix this by making the loop counter the same
type as num_parents. Also make num_parents an unsigned int to
match the return type of the call to clk_hw_get_num_parents.
Addresses-Coverity: ("Infinite loop")
Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clock
driver")
Signed-off-by: Colin Ian King
---
V2: Make num_parents an unsigned int to match return type of
clk_hw_get_num_parents().
---
drivers/clk/uniphier/clk-uniphier-mux.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c
b/drivers/clk/uniphier/clk-uniphier-mux.c
index 462c84321b2d..1998e9d4cfc0 100644
--- a/drivers/clk/uniphier/clk-uniphier-mux.c
+++ b/drivers/clk/uniphier/clk-uniphier-mux.c
@@ -31,10 +31,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw,
u8 index)
static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
{
struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw);
- int num_parents = clk_hw_get_num_parents(hw);
+ unsigned int num_parents = clk_hw_get_num_parents(hw);
int ret;
unsigned int val;
- u8 i;
+ unsigned int i;
ret = regmap_read(mux->regmap, mux->reg, );
if (ret)
--
2.30.2
[PATCH] net: sched: Fix potential infinite loop
From: Colin Ian King
The for-loop iterates with a u16 loop counter idx and compares this
with the loop upper limit of q->flows_cnt that is a u32 type.
There is a potential infinite loop if q->flows_cnt is larger than
the u8 loop counter. Fix this by making the loop counter the same
type as q->flows_cnt.
Addresses-Coverity: ("Infinite loop")
Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler")
Signed-off-by: Colin Ian King
---
net/sched/sch_fq_pie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c
index 949163fe68af..00563e137ecb 100644
--- a/net/sched/sch_fq_pie.c
+++ b/net/sched/sch_fq_pie.c
@@ -367,7 +367,7 @@ static void fq_pie_timer(struct timer_list *t)
struct fq_pie_sched_data *q = from_timer(q, t, adapt_timer);
struct Qdisc *sch = q->sch;
spinlock_t *root_lock; /* to lock qdisc for probability calculations */
- u16 idx;
+ u32 idx;
root_lock = qdisc_lock(qdisc_root_sleeping(sch));
spin_lock(root_lock);
--
2.30.2
[PATCH] clk: uniphier: Fix potential infinite loop
From: Colin Ian King
The for-loop iterates with a u8 loop counter i and compares this
with the loop upper limit of num_parents that is an int type.
There is a potential infinite loop if num_parents is larger than
the u8 loop counter. Fix this by making the loop counter the same
type as num_parents.
Addresses-Coverity: ("Infinite loop")
Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clock
driver")
Signed-off-by: Colin Ian King
---
drivers/clk/uniphier/clk-uniphier-mux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c
b/drivers/clk/uniphier/clk-uniphier-mux.c
index 462c84321b2d..ce219e0d2a85 100644
--- a/drivers/clk/uniphier/clk-uniphier-mux.c
+++ b/drivers/clk/uniphier/clk-uniphier-mux.c
@@ -34,7 +34,7 @@ static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
int num_parents = clk_hw_get_num_parents(hw);
int ret;
unsigned int val;
- u8 i;
+ int i;
ret = regmap_read(mux->regmap, mux->reg, );
if (ret)
--
2.30.2
[PATCH] staging: rtl8192u: Fix potential infinite loop
From: Colin Ian King
The for-loop iterates with a u8 loop counter i and compares this
with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum
that is a u16 type. There is a potential infinite loop if SlotNum
is larger than the u8 loop counter. Fix this by making the loop
counter the same type as SlotNum.
Addresses-Coverity: ("Infinite loop")
Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
Signed-off-by: Colin Ian King
---
drivers/staging/rtl8192u/r8192U_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8192u/r8192U_core.c
b/drivers/staging/rtl8192u/r8192U_core.c
index 9fc4adc83d77..b5a313649f44 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -3210,7 +3210,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv
*priv, u32 *TotalRxBcnNum,
u32 *TotalRxDataNum)
{
u16 SlotIndex;
- u8 i;
+ u16 i;
*TotalRxBcnNum = 0;
*TotalRxDataNum = 0;
--
2.30.2
[PATCH] bnx2x: Fix potential infinite loop
From: Colin Ian King
The for_each_tx_queue loop iterates with a u8 loop counter i and
compares this with the loop upper limit of bp->num_queues that
is an int type. There is a potential infinite loop if bp->num_queues
is larger than the u8 loop counter. Fix this by making the loop
counter the same type as bp->num_queues.
Addresses-Coverity: ("Infinite loop")
Fixes: ad5afc89365e ("bnx2x: Separate VF and PF logic")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 1a6ec1a12d53..edfbeb710ad4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2959,7 +2959,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
int bnx2x_drain_tx_queues(struct bnx2x *bp)
{
- u8 rc = 0, cos, i;
+ u8 rc = 0, cos;
+ int i;
/* Wait until tx fastpath tasks complete */
for_each_tx_queue(bp, i) {
--
2.30.2
[PATCH][next] media: venus: hfi,pm,firmware: Fix dereference before null check on hdev
From: Colin Ian King
The pointer hdev is being dereferenced twice on the assignment of
pointers cpu_cs_base and wrapper_base before hdev is being null
checked. Fix the potential null pointer dereference issues by
performing the null check of hdev before dereferencing it when
assigning cpu_cs_base and wrapper_base.
Addresses-Coverity: ("Dereference before null check")
Fixes: ff2a7013b3e6 ("media: venus: hfi,pm,firmware: Convert to block relative
addressing")
Signed-off-by: Colin Ian King
---
drivers/media/platform/qcom/venus/hfi_venus.c | 6 --
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c
b/drivers/media/platform/qcom/venus/hfi_venus.c
index cebb20cf371f..3eabb2646572 100644
--- a/drivers/media/platform/qcom/venus/hfi_venus.c
+++ b/drivers/media/platform/qcom/venus/hfi_venus.c
@@ -1094,12 +1094,14 @@ static irqreturn_t venus_isr(struct venus_core *core)
{
struct venus_hfi_device *hdev = to_hfi_priv(core);
u32 status;
- void __iomem *cpu_cs_base = hdev->core->cpu_cs_base;
- void __iomem *wrapper_base = hdev->core->wrapper_base;
+ void __iomem *cpu_cs_base, *wrapper_base;
if (!hdev)
return IRQ_NONE;
+ cpu_cs_base = hdev->core->cpu_cs_base;
+ wrapper_base = hdev->core->wrapper_base;
+
status = readl(wrapper_base + WRAPPER_INTR_STATUS);
if (IS_V6(core)) {
if (status & WRAPPER_INTR_STATUS_A2H_MASK ||
--
2.30.2
[PATCH][next] scsi: pm80xx: Fix potential infinite loop
From: Colin Ian King
The for-loop iterates with a u8 loop counter i and compares this
with the loop upper limit of pm8001_ha->max_q_num which is a u32
type. There is a potential infinite loop if pm8001_ha->max_q_num
is larger than the u8 loop counter. Fix this by making the loop
counter the same type as pm8001_ha->max_q_num.
Addresses-Coverity: ("Infinite loop")
Fixes: 65df7d1986a1 ("scsi: pm80xx: Fix chip initialization failure")
Signed-off-by: Colin Ian King
---
drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index d048455f4941..16edd84e7130 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -643,7 +643,7 @@ static void init_pci_device_addresses(struct
pm8001_hba_info *pm8001_ha)
*/
static int pm8001_chip_init(struct pm8001_hba_info *pm8001_ha)
{
- u8 i = 0;
+ u32 i = 0;
u16 deviceid;
pci_read_config_word(pm8001_ha->pdev, PCI_DEVICE_ID, );
/* 8081 controllers need BAR shift to access MPI space
--
2.30.2
[PATCH][next] media: venus: core,pm: fix potential infinite loop
From: Colin Ian King
The for-loop iterates with a u8 loop counter i and compares this
with the loop upper limit of res->resets_num which is an unsigned
int type. There is a potential infinite loop if res->resets_num
is larger than the u8 loop counter i. Fix this by making the loop
counter the same type as res->resets_num.
Addresses-Coverity: ("Infinite loop")
Fixes: 3bca43585e22 ("media: venus: core,pm: Add handling for resets")
Signed-off-by: Colin Ian King
---
drivers/media/platform/qcom/venus/pm_helpers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c
b/drivers/media/platform/qcom/venus/pm_helpers.c
index dfe3ee84eeb6..5c0a9aa23e83 100644
--- a/drivers/media/platform/qcom/venus/pm_helpers.c
+++ b/drivers/media/platform/qcom/venus/pm_helpers.c
@@ -868,7 +868,7 @@ static void vcodec_domains_put(struct venus_core *core)
static int core_resets_reset(struct venus_core *core)
{
const struct venus_resources *res = core->res;
- unsigned char i;
+ unsigned int i;
int ret;
if (!res->resets_num)
@@ -893,7 +893,7 @@ static int core_resets_get(struct venus_core *core)
{
struct device *dev = core->dev;
const struct venus_resources *res = core->res;
- unsigned char i;
+ unsigned int i;
int ret;
if (!res->resets_num)
--
2.30.2
[PATCH] staging: comedi: drivers: Fix spelling mistake "nubmer" -> "number"
From: Colin Ian King There is a spelling mistake in a comment. Fix it. Signed-off-by: Colin Ian King --- drivers/staging/comedi/drivers/addi_apci_16xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/addi_apci_16xx.c b/drivers/staging/comedi/drivers/addi_apci_16xx.c index 9bbef3b15f3f..c306aa41df97 100644 --- a/drivers/staging/comedi/drivers/addi_apci_16xx.c +++ b/drivers/staging/comedi/drivers/addi_apci_16xx.c @@ -110,7 +110,7 @@ static int apci16xx_auto_attach(struct comedi_device *dev, dev->iobase = pci_resource_start(pcidev, 0); /* -* Work out the nubmer of subdevices needed to support all the +* Work out the number of subdevices needed to support all the * digital i/o channels on the board. Each subdevice supports * up to 32 channels. */ -- 2.30.2
[PATCH][next] nvmet: Fix spelling mistake "nubmer" -> "number"
From: Colin Ian King
There is a spelling mistake in a pr_err error message. Fix it.
Signed-off-by: Colin Ian King
---
drivers/nvme/target/configfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 125ef2c65d5f..65a0cf99f557 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -1150,7 +1150,7 @@ static ssize_t
nvmet_subsys_attr_model_store_locked(struct nvmet_subsys *subsys,
return -EINVAL;
if (len > NVMET_MN_MAX_SIZE) {
- pr_err("Model nubmer size can not exceed %d Bytes\n",
+ pr_err("Model number size can not exceed %d Bytes\n",
NVMET_MN_MAX_SIZE);
return -EINVAL;
}
--
2.30.2
[PATCH] liquidio: Fix unintented sign extension of a left shift of a u16
From: Colin Ian King
The macro CN23XX_PEM_BAR1_INDEX_REG is being used to shift oct->pcie_port
(a u16) left 24 places. There are two subtle issues here, first the
shift gets promoted to an signed int and then sign extended to a u64.
If oct->pcie_port is 0x80 or more then the upper bits get sign extended
to 1. Secondly shfiting a u16 24 bits will lead to an overflow so it
needs to be cast to a u64 for all the bits to not overflow.
It is entirely possible that the u16 port value is never large enough
for this to fail, but it is useful to fix unintended overflows such
as this.
Fix this by casting the port parameter to the macro to a u64 before
the shift.
Addresses-Coverity: ("Unintended sign extension")
Fixes: 5bc67f587ba7 ("liquidio: CN23XX register definitions")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
index e6d4ad99cc38..92c27b148176 100644
--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
+++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
@@ -521,7 +521,7 @@
#defineCN23XX_BAR1_INDEX_OFFSET3
#defineCN23XX_PEM_BAR1_INDEX_REG(port, idx)\
- (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \
+ (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) <<
CN23XX_PEM_OFFSET) + \
((idx) << CN23XX_BAR1_INDEX_OFFSET))
/* DPI #*/
--
2.30.2
[PATCH] xircom: remove redundant error check on variable err
From: Colin Ian King
The error check on err is always false as err is always 0 at the
port_found label. The code is redundant and can be removed.
Addresses-Coverity: ("Logically dead code")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/xircom/xirc2ps_cs.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c
b/drivers/net/ethernet/xircom/xirc2ps_cs.c
index 3e337142b516..2049d76a0e68 100644
--- a/drivers/net/ethernet/xircom/xirc2ps_cs.c
+++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c
@@ -798,8 +798,6 @@ xirc2ps_config(struct pcmcia_device * link)
goto config_error;
}
port_found:
-if (err)
-goto config_error;
/
* Now allocate an interrupt line. Note that this does not
--
2.30.2
[PATCH] hwmon: (dme1737): Add missing null check on return from platform_get_resource
From: Colin Ian King
The call to platform_get_resource can potentially return a NULL pointer
on failure, so add this check and return -EINVAL if it fails.
Addresses-Coverity: ("Dereference null return")
Fixes: e95c237d78c0 ("hwmon: (dme1737) Add sch311x support")
Signed-off-by: Colin Ian King
---
drivers/hwmon/dme1737.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hwmon/dme1737.c b/drivers/hwmon/dme1737.c
index c1e4cfb40c3d..a2157872e126 100644
--- a/drivers/hwmon/dme1737.c
+++ b/drivers/hwmon/dme1737.c
@@ -2633,6 +2633,8 @@ static int dme1737_isa_probe(struct platform_device *pdev)
int err;
res = platform_get_resource(pdev, IORESOURCE_IO, 0);
+ if (!res)
+ return -EINVAL;
if (!devm_request_region(dev, res->start, DME1737_EXTENT, "dme1737")) {
dev_err(dev, "Failed to request region 0x%04x-0x%04x.\n",
(unsigned short)res->start,
--
2.30.2
[PATCH] usb: gadget: r8a66597: Add missing null check on return from platform_get_resource
From: Colin Ian King
The call to platform_get_resource can potentially return a NULL pointer
on failure, so add this check and return -EINVAL if it fails.
Addresses-Coverity: ("Dereference null return")
Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.")
Signed-off-by: Colin Ian King
---
drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c
b/drivers/usb/gadget/udc/r8a66597-udc.c
index 896c1a016d55..65cae4883454 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1849,6 +1849,8 @@ static int r8a66597_probe(struct platform_device *pdev)
return PTR_ERR(reg);
ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+ if (!ires)
+ return -EINVAL;
irq = ires->start;
irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
--
2.30.2
[PATCH][next] clk: socfpga: remove redundant initialization of variable div
From: Colin Ian King
The variable div is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/clk/socfpga/clk-gate-s10.c | 2 +-
drivers/clk/socfpga/clk-pll-s10.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/socfpga/clk-gate-s10.c
b/drivers/clk/socfpga/clk-gate-s10.c
index f9f403d7bb58..b84f2627551e 100644
--- a/drivers/clk/socfpga/clk-gate-s10.c
+++ b/drivers/clk/socfpga/clk-gate-s10.c
@@ -31,7 +31,7 @@ static unsigned long socfpga_dbg_clk_recalc_rate(struct
clk_hw *hwclk,
unsigned long parent_rate)
{
struct socfpga_gate_clk *socfpgaclk = to_socfpga_gate_clk(hwclk);
- u32 div = 1, val;
+ u32 div, val;
val = readl(socfpgaclk->div_reg) >> socfpgaclk->shift;
val &= GENMASK(socfpgaclk->width - 1, 0);
diff --git a/drivers/clk/socfpga/clk-pll-s10.c
b/drivers/clk/socfpga/clk-pll-s10.c
index bc37461d43c0..70076a80149d 100644
--- a/drivers/clk/socfpga/clk-pll-s10.c
+++ b/drivers/clk/socfpga/clk-pll-s10.c
@@ -107,7 +107,7 @@ static unsigned long clk_boot_clk_recalc_rate(struct clk_hw
*hwclk,
unsigned long parent_rate)
{
struct socfpga_pll *socfpgaclk = to_socfpga_clk(hwclk);
- u32 div = 1;
+ u32 div;
div = ((readl(socfpgaclk->hw.reg) &
SWCTRLBTCLKSEL_MASK) >>
--
2.30.2
[PATCH] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return
From: Colin Ian King
There is an error return path that is not kfree'ing socfpga_clk leading
to a memory leak. Fix this by adding in the missing kfree call.
Addresses-Coverity: ("Resource leak")
Signed-off-by: Colin Ian King
---
drivers/clk/socfpga/clk-gate-a10.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/socfpga/clk-gate-a10.c
b/drivers/clk/socfpga/clk-gate-a10.c
index f5cba8298712..738c53391e39 100644
--- a/drivers/clk/socfpga/clk-gate-a10.c
+++ b/drivers/clk/socfpga/clk-gate-a10.c
@@ -146,6 +146,7 @@ static void __init __socfpga_gate_init(struct device_node
*node,
if (IS_ERR(socfpga_clk->sys_mgr_base_addr)) {
pr_err("%s: failed to find altr,sys-mgr regmap!\n",
__func__);
+ kfree(socfpga_clk);
return;
}
}
--
2.30.2
[PATCH][next] net/mlx5: Fix bit-wise and with zero
From: Colin Ian King
The bit-wise and of the action field with MLX5_ACCEL_ESP_ACTION_DECRYPT
is incorrect as MLX5_ACCEL_ESP_ACTION_DECRYPT is zero and not intended
to be a bit-flag. Fix this by using the == operator as was originally
intended.
Addresses-Coverity: ("Logically dead code")
Fixes: 7dfee4b1d79e ("net/mlx5: IPsec, Refactor SA handle creation and
destruction")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index d43a05e77f67..0b19293cdd74 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -850,7 +850,7 @@ mlx5_fpga_ipsec_release_sa_ctx(struct
mlx5_fpga_ipsec_sa_ctx *sa_ctx)
return;
}
- if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action &
+ if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action ==
MLX5_ACCEL_ESP_ACTION_DECRYPT)
ida_free(>halloc, sa_ctx->sa_handle);
--
2.30.2
[PATCH][next] regmap-irq: Fix dereference of a potentially null d->virt_buf
From: Colin Ian King
The clean up of struct d can potentiallly index into a null array
d->virt_buf causing errorenous pointer dereferencing issues on
kfree calls. Fix this by adding a null check on d->virt_buf before
attempting to traverse the array to kfree the objects.
Addresses-Coverity: ("Dereference after null check")
Fixes: 4c5014456305 ("regmap-irq: Introduce virtual regs to handle more config
regs")
Signed-off-by: Colin Ian King
---
drivers/base/regmap/regmap-irq.c | 8 +---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index e6343ccc6aa1..760296a4b606 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -901,9 +901,11 @@ int regmap_add_irq_chip_fwnode(struct fwnode_handle
*fwnode,
kfree(d->mask_buf);
kfree(d->status_buf);
kfree(d->status_reg_buf);
- for (i = 0; i < chip->num_virt_regs; i++)
- kfree(d->virt_buf[i]);
- kfree(d->virt_buf);
+ if (d->virt_buf) {
+ for (i = 0; i < chip->num_virt_regs; i++)
+ kfree(d->virt_buf[i]);
+ kfree(d->virt_buf);
+ }
kfree(d);
return ret;
}
--
2.30.2
[PATCH][next] erofs: fix uninitialized variable i used in a while-loop
From: Colin Ian King
The while-loop iterates until src is non-null or i is 3, however, the
loop counter i is not intinitialied to zero, causing incorrect iteration
counts. Fix this by initializing it to zero.
Addresses-Coverity: ("Uninitialized scalar variable")
Fixes: 1aa5f2e2feed ("erofs: support decompress big pcluster for lz4 backend")
Signed-off-by: Colin Ian King
---
fs/erofs/decompressor.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index fe46a9c34923..8687ff81406b 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -154,6 +154,7 @@ static void *z_erofs_handle_inplace_io(struct
z_erofs_decompress_req *rq,
}
kunmap_atomic(inpage);
might_sleep();
+ i = 0;
while (1) {
src = vm_map_ram(rq->in, nrpages_in, -1);
/* retry two more times (totally 3 times) */
--
2.30.2
[PATCH][next] drm/msm: Fix spelling mistake "Purgable" -> "Purgeable"
From: Colin Ian King There is a spelling mistake in debugfs gem stats. Fix it. Also re-align output to cater for the extra 1 character. Signed-off-by: Colin Ian King --- drivers/gpu/drm/msm/msm_gem.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c index f146d9c5ba9c..4e2e0a93d17d 100644 --- a/drivers/gpu/drm/msm/msm_gem.c +++ b/drivers/gpu/drm/msm/msm_gem.c @@ -979,13 +979,13 @@ void msm_gem_describe_objects(struct list_head *list, struct seq_file *m) msm_gem_describe(obj, m, ); } - seq_printf(m, "Total:%4d objects, %9zu bytes\n", + seq_printf(m, "Total: %4d objects, %9zu bytes\n", stats.all.count, stats.all.size); - seq_printf(m, "Active: %4d objects, %9zu bytes\n", + seq_printf(m, "Active:%4d objects, %9zu bytes\n", stats.active.count, stats.active.size); - seq_printf(m, "Purgable: %4d objects, %9zu bytes\n", + seq_printf(m, "Purgeable: %4d objects, %9zu bytes\n", stats.purgable.count, stats.purgable.size); - seq_printf(m, "Purged: %4d objects, %9zu bytes\n", + seq_printf(m, "Purged:%4d objects, %9zu bytes\n", stats.purged.count, stats.purged.size); } #endif -- 2.30.2
[PATCH][next] drm/i915: Fix an uninitialized variable issue
From: Colin Ian King
Currently there is a while loop that contains a handful of continue
statements that can skip over the assignment of the variable err. At
the end of the loop there is a potiential for err to be unassigned
and possibly causing issues when err is checked for a non-zero value.
Fix this by setting err to zero before the while loop starts.
Addresses-Coverity: ("Uninitialized scalar variable")
Fixes: cf41a8f1dc1e ("drm/i915: Finally remove obj->mm.lock.")
Signed-off-by: Colin Ian King
---
drivers/gpu/drm/i915/gem/i915_gem_shrinker.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shrinker.c
b/drivers/gpu/drm/i915/gem/i915_gem_shrinker.c
index 3e248d3bd869..1e24ba872029 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_shrinker.c
@@ -180,6 +180,7 @@ i915_gem_shrink(struct i915_gem_ww_ctx *ww,
* the unbound/bound list until actually freed.
*/
spin_lock_irqsave(>mm.obj_lock, flags);
+ err = 0;
while (count < target &&
(obj = list_first_entry_or_null(phase->list,
typeof(*obj),
@@ -202,7 +203,6 @@ i915_gem_shrink(struct i915_gem_ww_ctx *ww,
spin_unlock_irqrestore(>mm.obj_lock, flags);
- err = 0;
if (unsafe_drop_pages(obj, shrink)) {
/* May arrive from get_pages on another bo */
if (!ww) {
--
2.30.2
[PATCH][next] crypto: sun8i-ss: Fix memory leak of pad
From: Colin Ian King
It appears there are several failure return paths that don't seem
to be free'ing pad. Fix these.
Addresses-Coverity: ("Resource leak")
Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms")
Signed-off-by: Colin Ian King
---
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
index 7d1fc9aba665..3c073eb3db03 100644
--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
@@ -348,8 +348,10 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void
*breq)
bf = (__le32 *)pad;
result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA);
- if (!result)
+ if (!result) {
+ kfree(pad);
return -ENOMEM;
+ }
for (i = 0; i < MAX_SG; i++) {
rctx->t_dst[i].addr = 0;
@@ -436,10 +438,9 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void
*breq)
DMA_TO_DEVICE);
dma_unmap_single(ss->dev, addr_res, digestsize, DMA_FROM_DEVICE);
- kfree(pad);
-
memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
theend:
+ kfree(pad);
kfree(result);
crypto_finalize_hash_request(engine, breq, err);
return 0;
--
2.30.2
[PATCH] crypto: sa2ul: Fix memory lead of rxd
From: Colin Ian King
There are two error return paths that are not freeing rxd and causing
memory leaks. Fix these.
Addresses-Coverity: ("Resource leak")
Fixes: 00c9211f60db ("crypto: sa2ul - Fix DMA mapping API usage")
Signed-off-by: Colin Ian King
---
drivers/crypto/sa2ul.c | 8 ++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index f300b0a5958a..ca7484aac727 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -1146,8 +1146,10 @@ static int sa_run(struct sa_req *req)
mapped_sg->sgt.sgl = src;
mapped_sg->sgt.orig_nents = src_nents;
ret = dma_map_sgtable(ddev, _sg->sgt, dir_src, 0);
- if (ret)
+ if (ret) {
+ kfree(rxd);
return ret;
+ }
mapped_sg->dir = dir_src;
mapped_sg->mapped = true;
@@ -1155,8 +1157,10 @@ static int sa_run(struct sa_req *req)
mapped_sg->sgt.sgl = req->src;
mapped_sg->sgt.orig_nents = sg_nents;
ret = dma_map_sgtable(ddev, _sg->sgt, dir_src, 0);
- if (ret)
+ if (ret) {
+ kfree(rxd);
return ret;
+ }
mapped_sg->dir = dir_src;
mapped_sg->mapped = true;
--
2.30.2
[PATCH][V2] crypto: sa2ul: Fix memory leak of rxd
From: Colin Ian King
There are two error return paths that are not freeing rxd and causing
memory leaks. Fix these.
Addresses-Coverity: ("Resource leak")
Fixes: 00c9211f60db ("crypto: sa2ul - Fix DMA mapping API usage")
Signed-off-by: Colin Ian King
---
V2: Fix typo in $SUBJECT
---
drivers/crypto/sa2ul.c | 8 ++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index f300b0a5958a..ca7484aac727 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -1146,8 +1146,10 @@ static int sa_run(struct sa_req *req)
mapped_sg->sgt.sgl = src;
mapped_sg->sgt.orig_nents = src_nents;
ret = dma_map_sgtable(ddev, _sg->sgt, dir_src, 0);
- if (ret)
+ if (ret) {
+ kfree(rxd);
return ret;
+ }
mapped_sg->dir = dir_src;
mapped_sg->mapped = true;
@@ -1155,8 +1157,10 @@ static int sa_run(struct sa_req *req)
mapped_sg->sgt.sgl = req->src;
mapped_sg->sgt.orig_nents = sg_nents;
ret = dma_map_sgtable(ddev, _sg->sgt, dir_src, 0);
- if (ret)
+ if (ret) {
+ kfree(rxd);
return ret;
+ }
mapped_sg->dir = dir_src;
mapped_sg->mapped = true;
--
2.30.2
[PATCH][next] ice: Fix potential infinite loop when using u8 loop counter
From: Colin Ian King
A for-loop is using a u8 loop counter that is being compared to
a u32 cmp_dcbcfg->numapp to check for the end of the loop. If
cmp_dcbcfg->numapp is larger than 255 then the counter j will wrap
around to zero and hence an infinite loop occurs. Fix this by making
counter j the same type as cmp_dcbcfg->numapp.
Addresses-Coverity: ("Infinite loop")
Fixes: aeac8ce864d9 ("ice: Recognize 860 as iSCSI port in CEE mode")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/intel/ice/ice_dcb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_dcb.c
b/drivers/net/ethernet/intel/ice/ice_dcb.c
index 43c6af42de8a..ee4f320d4823 100644
--- a/drivers/net/ethernet/intel/ice/ice_dcb.c
+++ b/drivers/net/ethernet/intel/ice/ice_dcb.c
@@ -747,8 +747,8 @@ ice_cee_to_dcb_cfg(struct ice_aqc_get_cee_dcb_cfg_resp
*cee_cfg,
struct ice_port_info *pi)
{
u32 status, tlv_status = le32_to_cpu(cee_cfg->tlv_status);
- u32 ice_aqc_cee_status_mask, ice_aqc_cee_status_shift;
- u8 i, j, err, sync, oper, app_index, ice_app_sel_type;
+ u32 ice_aqc_cee_status_mask, ice_aqc_cee_status_shift, j;
+ u8 i, err, sync, oper, app_index, ice_app_sel_type;
u16 app_prio = le16_to_cpu(cee_cfg->oper_app_prio);
u16 ice_aqc_cee_app_mask, ice_aqc_cee_app_shift;
struct ice_dcbx_cfg *cmp_dcbcfg, *dcbcfg;
--
2.30.2
[PATCH][next] netfilter: nf_log_bridge: Fix missing assignment of ret on a call to nf_log_register
From: Colin Ian King
Currently the call to nf_log_register is returning an error code that
is not being assigned to ret and yet ret is being checked. Fix this by
adding in the missing assignment.
Addresses-Coverity: ("Logically dead code")
Fixes: 8d02e7da87a0 ("netfilter: nf_log_bridge: merge with nf_log_syslog")
Signed-off-by: Colin Ian King
---
net/netfilter/nf_log_syslog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index 025ab9c66d13..2518818ed479 100644
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -1042,7 +1042,7 @@ static int __init nf_log_syslog_init(void)
if (ret < 0)
goto err4;
- nf_log_register(NFPROTO_BRIDGE, _bridge_logger);
+ ret = nf_log_register(NFPROTO_BRIDGE, _bridge_logger);
if (ret < 0)
goto err5;
--
2.30.2
[PATCH][next] soundwire: qcom: Fix a u8 comparison with less than zero
From: Colin Ian King
Variable devnum is being checked for a less than zero error return
however the comparison will always be false because devnum is an 8 bit
unsigned integer. Fix this by making devnum an int. Also there is no
need to iniitialize devnum with zero as this value is no read, so
remove the redundant assignment.
Addresses-Coverity: ("Unsigned compared against 0")
Fixes: c7d49c76d1d5 ("soundwire: qcom: add support to new interrupts")
Signed-off-by: Colin Ian King
---
drivers/soundwire/qcom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
index b08ecb9b418c..ec86c4e53fdb 100644
--- a/drivers/soundwire/qcom.c
+++ b/drivers/soundwire/qcom.c
@@ -428,7 +428,7 @@ static irqreturn_t qcom_swrm_irq_handler(int irq, void
*dev_id)
struct qcom_swrm_ctrl *swrm = dev_id;
u32 value, intr_sts, intr_sts_masked, slave_status;
u32 i;
- u8 devnum = 0;
+ int devnum;
int ret = IRQ_HANDLED;
swrm->reg_read(swrm, SWRM_INTERRUPT_STATUS, _sts);
--
2.30.2
[PATCH][next] drm/amd/display: remove redundant initialization of variable status
From: Colin Ian King
The variable status is being initialized with a value that is
never read and it is being updated later with a new value.
The initialization is redundant and can be removed. Also clean
up an indentation.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 9 -
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index b092627bd661..4c226db777dc 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1729,12 +1729,11 @@ bool perform_link_training_with_retries(
dc_link_dp_perform_link_training_skip_aux(link,
link_setting);
return true;
} else {
- enum link_training_result status =
LINK_TRAINING_CR_FAIL_LANE0;
+ enum link_training_result status;
- status = dc_link_dp_perform_link_training(
-
link,
-
link_setting,
-
skip_video_pattern);
+ status = dc_link_dp_perform_link_training(link,
+ link_setting,
+
skip_video_pattern);
if (status == LINK_TRAINING_SUCCESS)
return true;
}
--
2.30.2
[PATCH][next] ASoC: mediatek: mt6359: Fix spelling mistake "reate" -> "create"
From: Colin Ian King
There is a spelling mistake in a dev_err error message. Fix it.
Signed-off-by: Colin Ian King
---
sound/soc/codecs/mt6359-accdet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/mt6359-accdet.c b/sound/soc/codecs/mt6359-accdet.c
index 0bef6eaad5ad..4222aed013f1 100644
--- a/sound/soc/codecs/mt6359-accdet.c
+++ b/sound/soc/codecs/mt6359-accdet.c
@@ -1019,7 +1019,7 @@ static int mt6359_accdet_probe(struct platform_device
*pdev)
priv->jd_workqueue = create_singlethread_workqueue("mt6359_accdet_jd");
INIT_WORK(>jd_work, mt6359_accdet_jd_work);
if (!priv->jd_workqueue) {
- dev_err(>dev, "Failed to reate jack detect workqueue\n");
+ dev_err(>dev, "Failed to create jack detect workqueue\n");
ret = -1;
goto err_eint_wq;
}
--
2.30.2
[PATCH][next] mm/vmalloc: Fix read of pointer area after it has been free'd
From: Colin Ian King
Currently the memory pointed to by area is being freed by the
free_vm_area call and then area->nr_pages is referencing the
free'd object. Fix this swapping the order of the warn_alloc
message and the free.
Addresses-Coverity: ("Read from pointer after free")
Fixes: 014ccf9b888d ("mm/vmalloc: improve allocation failure error messages")
Signed-off-by: Colin Ian King
---
mm/vmalloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index b73e4e715e0d..7936405749e4 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2790,11 +2790,11 @@ static void *__vmalloc_area_node(struct vm_struct
*area, gfp_t gfp_mask,
}
if (!pages) {
- free_vm_area(area);
warn_alloc(gfp_mask, NULL,
"vmalloc size %lu allocation failure: "
"page array size %lu allocation failed",
area->nr_pages * PAGE_SIZE, array_size);
+ free_vm_area(area);
return NULL;
}
--
2.30.2
[PATCH] i915: Fix uninitialized variable err
From: Colin Ian King
In the case where !sg_dma_len(sgl) breaks out of the do-while loop
on the first iteration, error variable err has not been assigned
any value and will contain garbage. Fix this by ensuring err is
initialized to zero.
Addresses-Coverity: ("Uninitialized scalar variable")
Fixes: 204302d90503 ("i915: fix remap_io_sg to verify the pgprot")
Signed-off-by: Colin Ian King
---
drivers/gpu/drm/i915/i915_mm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/i915_mm.c b/drivers/gpu/drm/i915/i915_mm.c
index 4c8cd08c672d..25576fa73ff0 100644
--- a/drivers/gpu/drm/i915/i915_mm.c
+++ b/drivers/gpu/drm/i915/i915_mm.c
@@ -47,7 +47,7 @@ int remap_io_sg(struct vm_area_struct *vma,
struct scatterlist *sgl, resource_size_t iobase)
{
unsigned long pfn, len, remapped = 0;
- int err;
+ int err = 0;
/* We rely on prevalidation of the io-mapping to skip track_pfn(). */
GEM_BUG_ON((vma->vm_flags & EXPECTED_FLAGS) != EXPECTED_FLAGS);
--
2.30.2
[PATCH] ieee802154: hwsim: remove redundant initialization of variable res
From: Colin Ian King
The variable res is being initialized with a value that is
never read and it is being updated later with a new value.
The initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/net/ieee802154/mac802154_hwsim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c
b/drivers/net/ieee802154/mac802154_hwsim.c
index c0bf7d78276e..da9135231c07 100644
--- a/drivers/net/ieee802154/mac802154_hwsim.c
+++ b/drivers/net/ieee802154/mac802154_hwsim.c
@@ -268,7 +268,7 @@ static int hwsim_get_radio(struct sk_buff *skb, struct
hwsim_phy *phy,
struct netlink_callback *cb, int flags)
{
void *hdr;
- int res = -EMSGSIZE;
+ int res;
hdr = genlmsg_put(skb, portid, seq, _genl_family, flags,
MAC802154_HWSIM_CMD_GET_RADIO);
--
2.30.2
[PATCH] lan743x: remove redundant intializations of pointers adapter and phydev
From: Colin Ian King
The pointers adapter and phydev are being initialized with values that
are never read and are being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/microchip/lan743x_ethtool.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/microchip/lan743x_ethtool.c
b/drivers/net/ethernet/microchip/lan743x_ethtool.c
index c5de8f46cdd3..91a755efe2e6 100644
--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c
+++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c
@@ -730,8 +730,8 @@ static int lan743x_ethtool_get_eee(struct net_device
*netdev,
static int lan743x_ethtool_set_eee(struct net_device *netdev,
struct ethtool_eee *eee)
{
- struct lan743x_adapter *adapter = netdev_priv(netdev);
- struct phy_device *phydev = NULL;
+ struct lan743x_adapter *adapter;
+ struct phy_device *phydev;
u32 buf = 0;
int ret = 0;
--
2.30.2
[PATCH] mac80211: remove redundant assignment of variable result
From: Colin Ian King
The variable result is being assigned a value that is never
read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
net/mac80211/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5d06de61047a..2fba9db56e47 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1684,7 +1684,7 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata;
struct ieee80211_vif *vif;
struct sk_buff *skb;
- bool result = true;
+ bool result;
__le16 fc;
if (WARN_ON(skb_queue_empty(skbs)))
--
2.30.2
[PATCH] USB: serial: iuu_phoenix: remove redundant variable 'error'
From: Colin Ian King
The variable error is initialized to 0 and is set to 1 this
value is never read as it is on an immediate return path. The
only read of error is to check it is 0 and this check is always
true at that point of the code. The variable is redundant and
can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/usb/serial/iuu_phoenix.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 093afd67a664..19753611e7b0 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -643,7 +643,6 @@ static void iuu_uart_read_callback(struct urb *urb)
struct iuu_private *priv = usb_get_serial_port_data(port);
unsigned long flags;
int status = urb->status;
- int error = 0;
int len = 0;
unsigned char *data = urb->transfer_buffer;
priv->poll++;
@@ -660,12 +659,11 @@ static void iuu_uart_read_callback(struct urb *urb)
if (urb->actual_length > 1) {
dev_dbg(>dev, "%s - urb->actual_length = %i\n", __func__,
urb->actual_length);
- error = 1;
return;
}
/* if len > 0 call readbuf */
- if (len > 0 && error == 0) {
+ if (len > 0) {
dev_dbg(>dev, "%s - call read buf - len to read is %i\n",
__func__, len);
status = iuu_read_buf(port, len);
--
2.30.2
[PATCH] scsi: qedi: emove redundant assignment to variable err
From: Colin Ian King
variable err is assigned -ENOMEM followed by an error return path
via label err_udev that does not access the variable and returns
with the -ENOMEM error return code. The assignment to err is
redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/scsi/qedi/qedi_main.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 69c5b5ee2169..2455d1448a7e 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -276,10 +276,8 @@ static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
}
udev = kzalloc(sizeof(*udev), GFP_KERNEL);
- if (!udev) {
- rc = -ENOMEM;
+ if (!udev)
goto err_udev;
- }
udev->uio_dev = -1;
--
2.30.2
[PATCH] rtlwifi: remove redundant assignment to variable err
From: Colin Ian King
Variable err is assigned -ENODEV followed by an error return path
via label error_out that does not access the variable and returns
with the -ENODEV error return code. The assignment to err is
redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/net/wireless/realtek/rtlwifi/usb.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c
b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 6c5e242b1bc5..37a9a03123f3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1070,7 +1070,6 @@ int rtl_usb_probe(struct usb_interface *intf,
err = ieee80211_register_hw(hw);
if (err) {
pr_err("Can't register mac80211 hw.\n");
- err = -ENODEV;
goto error_out;
}
rtlpriv->mac80211.mac80211_registered = 1;
--
2.30.2
[PATCH] mfd: timberdale: remove redundant assignment to variable err
From: Colin Ian King Variable err is assigned -ENODEV followed by an error return path via label err_mfd that does not access the variable and returns with the -ENODEV error return code. The assignment to err is redundant and can be removed. Signed-off-by: Colin Ian King --- drivers/mfd/timberdale.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/mfd/timberdale.c b/drivers/mfd/timberdale.c index faecbca6dba3..0a9872ed722f 100644 --- a/drivers/mfd/timberdale.c +++ b/drivers/mfd/timberdale.c @@ -766,7 +766,6 @@ static int timb_probe(struct pci_dev *dev, default: dev_err(>dev, "Unknown IP setup: %d.%d.%d\n", priv->fw.major, priv->fw.minor, ip_setup); - err = -ENODEV; goto err_mfd; } -- 2.30.2
[PATCH][next] mlxsw: spectrum_router: remove redundant initialization of variable force
From: Colin Ian King
The variable force is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 6ccaa194733b..ff240e3c29f7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -5059,7 +5059,7 @@ mlxsw_sp_nexthop_obj_bucket_adj_update(struct mlxsw_sp
*mlxsw_sp,
{
u16 bucket_index = info->nh_res_bucket->bucket_index;
struct netlink_ext_ack *extack = info->extack;
- bool force = info->nh_res_bucket->force;
+ bool force;
char ratr_pl_new[MLXSW_REG_RATR_LEN];
char ratr_pl[MLXSW_REG_RATR_LEN];
u32 adj_index;
--
2.30.2
[PATCH] io_uring: remove unsued assignment to pointer io
From: Colin Ian King There is an assignment to io that is never read after the assignment, the assignment is redundant and can be removed. Signed-off-by: Colin Ian King --- fs/io_uring.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 046216c1b7d5..17a8adec47f0 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -4787,7 +4787,6 @@ static int io_connect(struct io_kiocb *req, unsigned int issue_flags) ret = -ENOMEM; goto out; } - io = req->async_data; memcpy(req->async_data, &__io, sizeof(__io)); return -EAGAIN; } -- 2.30.2
[PATCH] bpf: remove redundant assignment of variable id
From: Colin Ian King
The variable id is being assigned a value that is never
read, the assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
kernel/bpf/btf.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 369faeddf1df..b22fb29347c0 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -789,7 +789,6 @@ static const struct btf_type
*btf_type_skip_qualifiers(const struct btf *btf,
while (btf_type_is_modifier(t) &&
BTF_INFO_KIND(t->info) != BTF_KIND_TYPEDEF) {
- id = t->type;
t = btf_type_by_id(btf, t->type);
}
--
2.30.2
[PATCH] drivers: net: smc91x: remove redundant initialization of pointer gpio
From: Colin Ian King
The pointer gpio is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/smsc/smc91x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/smsc/smc91x.c
b/drivers/net/ethernet/smsc/smc91x.c
index abd083efbfd7..bc19db2dbafb 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2205,7 +2205,7 @@ static int try_toggle_control_gpio(struct device *dev,
const char *name, int index,
int value, unsigned int nsdelay)
{
- struct gpio_desc *gpio = *desc;
+ struct gpio_desc *gpio;
enum gpiod_flags flags = value ? GPIOD_OUT_LOW : GPIOD_OUT_HIGH;
gpio = devm_gpiod_get_index_optional(dev, name, index, flags);
--
2.30.2
[PATCH] platform/x86: panasonic-laptop: remove redundant assignment of variable result
From: Colin Ian King
The variable result is being assigned a value that is never
read and it is being updated later with a new value. The
assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/platform/x86/panasonic-laptop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/panasonic-laptop.c
b/drivers/platform/x86/panasonic-laptop.c
index 6388c3c705a6..d4f01496 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -973,7 +973,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
pcc->mute = pcc->sinf[SINF_MUTE];
pcc->ac_brightness = pcc->sinf[SINF_AC_CUR_BRIGHT];
pcc->dc_brightness = pcc->sinf[SINF_DC_CUR_BRIGHT];
- result = pcc->current_brightness = pcc->sinf[SINF_CUR_BRIGHT];
+ pcc->current_brightness = pcc->sinf[SINF_CUR_BRIGHT];
/* add sysfs attributes */
result = sysfs_create_group(>dev.kobj, _attr_group);
--
2.30.2
[PATCH] usb: cdnsp: remove redundant initialization of variable ret
From: Colin Ian King
The variable ret is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/usb/cdns3/cdnsp-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c
index 7a84e928710e..d87b640e7b49 100644
--- a/drivers/usb/cdns3/cdnsp-mem.c
+++ b/drivers/usb/cdns3/cdnsp-mem.c
@@ -686,7 +686,7 @@ static void cdnsp_free_priv_device(struct cdnsp_device
*pdev)
static int cdnsp_alloc_priv_device(struct cdnsp_device *pdev)
{
- int ret = -ENOMEM;
+ int ret;
ret = cdnsp_init_device_ctx(pdev);
if (ret)
--
2.30.2
[PATCH] PCI: endpoint: remove redundant initialization of pointer dev
From: Colin Ian King
The pointer dev is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/pci/endpoint/pci-epf-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/endpoint/pci-epf-core.c
b/drivers/pci/endpoint/pci-epf-core.c
index 7646c8660d42..e9289d10f822 100644
--- a/drivers/pci/endpoint/pci-epf-core.c
+++ b/drivers/pci/endpoint/pci-epf-core.c
@@ -113,7 +113,7 @@ EXPORT_SYMBOL_GPL(pci_epf_bind);
void pci_epf_free_space(struct pci_epf *epf, void *addr, enum pci_barno bar,
enum pci_epc_interface_type type)
{
- struct device *dev = epf->epc->dev.parent;
+ struct device *dev;
struct pci_epf_bar *epf_bar;
struct pci_epc *epc;
--
2.30.2
[PATCH][next] ethtool: fec: Fix bitwise-and with ETHTOOL_FEC_NONE
From: Colin Ian King
Currently ETHTOOL_FEC_NONE_BIT is being used as a mask, however
this is zero and the mask should be using ETHTOOL_FEC_NONE instead.
Fix this.
Addresses-Coverity: ("Bitwise-and with zero")
Fixes: 42ce127d9864 ("ethtool: fec: sanitize ethtool_fecparam->fec")
Signed-off-by: Colin Ian King
---
net/ethtool/ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 8797533ddc4b..26b3e7086075 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -2586,7 +2586,7 @@ static int ethtool_set_fecparam(struct net_device *dev,
void __user *useraddr)
if (copy_from_user(, useraddr, sizeof(fecparam)))
return -EFAULT;
- if (!fecparam.fec || fecparam.fec & ETHTOOL_FEC_NONE_BIT)
+ if (!fecparam.fec || fecparam.fec & ETHTOOL_FEC_NONE)
return -EINVAL;
fecparam.active_fec = 0;
--
2.30.2
[PATCH] mtd: cfi: remove redundant assignment to variable timeo
From: Colin Ian King
The variable timeo is being initialized with a value that is never read
and it is being updated later with a new value. The initialization is
redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/mtd/chips/cfi_cmdset_0002.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c
b/drivers/mtd/chips/cfi_cmdset_0002.c
index 6f6b0265c22d..54926b72c331 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1650,7 +1650,7 @@ static int __xipram do_write_oneword_once(struct map_info
*map,
unsigned long adr, map_word datum,
int mode, struct cfi_private *cfi)
{
- unsigned long timeo = jiffies + HZ;
+ unsigned long timeo;
/*
* We use a 1ms + 1 jiffies generic timeout for writes (most devices
* have a max write time of a few hundreds usec). However, we should
--
2.30.2
[PATCH][next] cifsd: remove redundant assignment to variable err
From: Colin Ian King
The variable err is being initialized with a value that is never read
and it is being updated later with a new value. The initialization is
redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
fs/cifsd/vfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifsd/vfs.c b/fs/cifsd/vfs.c
index 00f80ca45690..3d7413b8f526 100644
--- a/fs/cifsd/vfs.c
+++ b/fs/cifsd/vfs.c
@@ -587,7 +587,7 @@ int ksmbd_vfs_remove_file(struct ksmbd_work *work, char
*name)
struct path parent;
struct dentry *dir, *dentry;
char *last;
- int err = -ENOENT;
+ int err;
last = extract_last_component(name);
if (!last)
--
2.30.2
[PATCH][next] thermal/drivers/devfreq_cooling: Fix error return if kasprintf returns NULL
From: Colin Ian King
Currently when kasprintf fails and returns NULL, the error return -ENOMEM
is being assigned to cdev instead of err causing the return via the label
remove_qos_re to return the incorrect error code. Fix this by explicitly
setting err before taking the error return path.
Addresses-Coverity: ("Unused valued")
Fixes: f8d354e821b2 ("thermal/drivers/devfreq_cooling: Use device name instead
of auto-numbering")
Signed-off-by: Colin Ian King
---
drivers/thermal/devfreq_cooling.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/thermal/devfreq_cooling.c
b/drivers/thermal/devfreq_cooling.c
index fb250ac16f50..2c7e9e9cfbe1 100644
--- a/drivers/thermal/devfreq_cooling.c
+++ b/drivers/thermal/devfreq_cooling.c
@@ -402,10 +402,11 @@ of_devfreq_cooling_register_power(struct device_node *np,
struct devfreq *df,
if (err < 0)
goto free_table;
- cdev = ERR_PTR(-ENOMEM);
name = kasprintf(GFP_KERNEL, "devfreq-%s", dev_name(dev));
- if (!name)
+ if (!name) {
+ err = -ENOMEM;
goto remove_qos_req;
+ }
cdev = thermal_of_cooling_device_register(np, name, dfc,
_cooling_ops);
--
2.30.2
[PATCH][next] scsi: a100u2w: remove unused variable biosaddr
From: Colin Ian King
The variable biosaddr is being assigned a value that is never read,
the variable is redundant and can be safely removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King
---
drivers/scsi/a100u2w.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/scsi/a100u2w.c b/drivers/scsi/a100u2w.c
index c9ed210d77b3..028af6b1057c 100644
--- a/drivers/scsi/a100u2w.c
+++ b/drivers/scsi/a100u2w.c
@@ -1088,7 +1088,6 @@ static int inia100_probe_one(struct pci_dev *pdev,
unsigned long port, bios;
int error = -ENODEV;
u32 sz;
- unsigned long biosaddr;
if (pci_enable_device(pdev))
goto out;
@@ -1138,8 +1137,6 @@ static int inia100_probe_one(struct pci_dev *pdev,
goto out_free_scb_array;
}
- biosaddr = host->BIOScfg;
- biosaddr = (biosaddr << 4);
if (init_orchid(host)) {/* Initialize orchid chip */
printk("inia100: initial orchid fail!!\n");
goto out_free_escb_array;
--
2.30.2
[PATCH][next] staging: rtl8188eu: Fix null pointer dereference on free_netdev call
From: Colin Ian King
An unregister_netdev call checks if pnetdev is null, hence a later
call to free_netdev can potentially be passing a null pointer, causing
a null pointer dereference. Avoid this by adding a null pointer check
on pnetdev before calling free_netdev.
Fixes: 1665c8fdffbb ("staging: rtl8188eu: use netdev routines for private data")
Signed-off-by: Colin Ian King
---
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 518e9feb3f46..91a3d34a1050 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -446,7 +446,8 @@ static void rtw_usb_if1_deinit(struct adapter *if1)
pr_debug("+r871xu_dev_remove, hw_init_completed=%d\n",
if1->hw_init_completed);
rtw_free_drv_sw(if1);
- free_netdev(pnetdev);
+ if (pnetdev)
+ free_netdev(pnetdev);
}
static int rtw_drv_init(struct usb_interface *pusb_intf, const struct
usb_device_id *pdid)
--
2.30.2
[PATCH][next] net: bridge: Fix missing return assignment from br_vlan_replay_one call
From: Colin Ian King
The call to br_vlan_replay_one is returning an error return value but
this is not being assigned to err and the following check on err is
currently always false because err was initialized to zero. Fix this
by assigning err.
Addresses-Coverity: ("'Constant' variable guards dead code")
Fixes: 22f67cdfae6a ("net: bridge: add helper to replay VLANs installed on
port")
Signed-off-by: Colin Ian King
---
net/bridge/br_vlan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index ca8daccff217..7422691230b1 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -1815,7 +1815,7 @@ int br_vlan_replay(struct net_device *br_dev, struct
net_device *dev,
if (!br_vlan_should_use(v))
continue;
- br_vlan_replay_one(nb, dev, , extack);
+ err = br_vlan_replay_one(nb, dev, , extack);
if (err)
return err;
}
--
2.30.2
[PATCH][next] media: imx-jpeg: Pass the v4l2_jpeg_header header argument by reference
From: Colin Ian King
Currently the header argument is being passed by value, so a copy of 256
byte structure on the stack is potentially occurring. Fix this by passing
by reference to avoid any large stack copies.
Addresses-Coverity: ("Big parameter passed by value")
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG
Encoder/Decoder")
Signed-off-by: Colin Ian King
---
drivers/media/platform/imx-jpeg/mxc-jpeg.c | 14 +++---
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.c
b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
index adb1715c75d7..f13a8efc35ad 100644
--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
@@ -1114,21 +1114,21 @@ static int mxc_jpeg_valid_comp_id(struct device *dev,
}
static u32 mxc_jpeg_get_image_format(struct device *dev,
-const struct v4l2_jpeg_header header)
+const struct v4l2_jpeg_header *header)
{
int i;
u32 fourcc = 0;
for (i = 0; i < MXC_JPEG_NUM_FORMATS; i++)
- if (mxc_formats[i].subsampling == header.frame.subsampling &&
- mxc_formats[i].nc == header.frame.num_components) {
+ if (mxc_formats[i].subsampling == header->frame.subsampling &&
+ mxc_formats[i].nc == header->frame.num_components) {
fourcc = mxc_formats[i].fourcc;
break;
}
if (fourcc == 0) {
dev_err(dev, "Could not identify image format nc=%d,
subsampling=%d\n",
- header.frame.num_components,
- header.frame.subsampling);
+ header->frame.num_components,
+ header->frame.subsampling);
return fourcc;
}
/*
@@ -1137,7 +1137,7 @@ static u32 mxc_jpeg_get_image_format(struct device *dev,
* ITU-T T.872 chapter 6.5.3 APP14 marker segment for colour encoding
*/
if (fourcc == V4L2_PIX_FMT_YUV24 || fourcc == V4L2_PIX_FMT_RGB24) {
- if (header.app14_tf == V4L2_JPEG_APP14_TF_CMYK_RGB)
+ if (header->app14_tf == V4L2_JPEG_APP14_TF_CMYK_RGB)
fourcc = V4L2_PIX_FMT_RGB24;
else
fourcc = V4L2_PIX_FMT_YUV24;
@@ -1258,7 +1258,7 @@ static int mxc_jpeg_parse(struct mxc_jpeg_ctx *ctx,
if (!mxc_jpeg_valid_comp_id(dev, psof, psos))
dev_warn(dev, "JPEG component ids should be 0-3 or 1-4");
- fourcc = mxc_jpeg_get_image_format(dev, header);
+ fourcc = mxc_jpeg_get_image_format(dev, );
if (fourcc == 0)
return -EINVAL;
--
2.30.2
[PATCH][next] drm/amd/display/dc/calcs/dce_calcs: Fix allocation size for dceip and vbios
From: Colin Ian King
Currently the allocations for dceip and vbios are based on the size of
the pointer rather than the size of the data structures, causing heap
issues. Fix this by using the correct allocation sizes.
Addresses-Coverity: ("Wrong size of argument")
Fixes: a2a855772210 ("drm/amd/display/dc/calcs/dce_calcs: Remove some large
variables from the stack")
Signed-off-by: Colin Ian King
---
drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c
b/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c
index 556ecfabc8d2..1244fcb0f446 100644
--- a/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c
@@ -2051,11 +2051,11 @@ void bw_calcs_init(struct bw_calcs_dceip *bw_dceip,
enum bw_calcs_version version = bw_calcs_version_from_asic_id(asic_id);
- dceip = kzalloc(sizeof(dceip), GFP_KERNEL);
+ dceip = kzalloc(sizeof(*dceip), GFP_KERNEL);
if (!dceip)
return;
- vbios = kzalloc(sizeof(vbios), GFP_KERNEL);
+ vbios = kzalloc(sizeof(*vbios), GFP_KERNEL);
if (!vbios) {
kfree(dceip);
return;
--
2.30.2
[PATCH][next] media: dvb-frontends: Remove redundant error check on variable ret
From: Colin Ian King
An earlier commit removed a call to lgdt3306a_spectral_inversion and
omitted to remove the error return check. The check on ret is now
redundant and can be removed.
Addresses-Coverity: ("Logically dead code")
Fixes: d4a3fa6652e3 ("media: dvb-frontends: lgdt3306a.c: remove dead code")
Signed-off-by: Colin Ian King
---
drivers/media/dvb-frontends/lgdt3306a.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/media/dvb-frontends/lgdt3306a.c
b/drivers/media/dvb-frontends/lgdt3306a.c
index 22d484487695..136b76cb4807 100644
--- a/drivers/media/dvb-frontends/lgdt3306a.c
+++ b/drivers/media/dvb-frontends/lgdt3306a.c
@@ -1017,9 +1017,6 @@ static int lgdt3306a_set_parameters(struct dvb_frontend
*fe)
/* spectral_inversion defaults already set for VSB and QAM */
- if (lg_chkerr(ret))
- goto fail;
-
ret = lgdt3306a_mpeg_mode(state, state->cfg->mpeg_mode);
if (lg_chkerr(ret))
goto fail;
--
2.30.2
[PATCH] octeontx2-af: Fix memory leak of object buf
From: Colin Ian King
Currently the error return path when lfs fails to allocate is not free'ing
the memory allocated to buf. Fix this by adding the missing kfree.
Addresses-Coverity: ("Resource leak")
Fixes: f7884097141b ("octeontx2-af: Formatting debugfs entry rsrc_alloc.")
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index 8ec17ee72b5d..9bf8eaabf9ab 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -253,8 +253,10 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file
*filp,
return -ENOSPC;
lfs = kzalloc(lf_str_size, GFP_KERNEL);
- if (!lfs)
+ if (!lfs) {
+ kfree(buf);
return -ENOMEM;
+ }
off += scnprintf([off], buf_size - 1 - off, "%-*s", lf_str_size,
"pcifunc");
for (index = 0; index < BLK_COUNT; index++)
--
2.30.2
[PATCH][next] media: imx-jpeg: Fix spelling mistake "Canot" -> "Cannot"
From: Colin Ian King
There is a spelling mistake in a dev_err message. Fix it.
Signed-off-by: Colin Ian King
---
drivers/media/platform/imx-jpeg/mxc-jpeg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.c
b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
index 2d29558f1864..adb1715c75d7 100644
--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
@@ -947,7 +947,7 @@ static void mxc_jpeg_device_run(void *priv)
goto end;
}
if (!mxc_jpeg_alloc_slot_data(jpeg, ctx->slot)) {
- dev_err(dev, "Canot allocate slot data\n");
+ dev_err(dev, "Cannot allocate slot data\n");
goto end;
}
--
2.30.2
[PATCH][next] iommu: Fix spelling mistake "sixe" -> "size"
From: Colin Ian King
There is a spelling mistake in a dev_err message. Fix it.
Signed-off-by: Colin Ian King
---
drivers/iommu/sprd-iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/sprd-iommu.c b/drivers/iommu/sprd-iommu.c
index 7100ed17dcce..e1dc2f7d5639 100644
--- a/drivers/iommu/sprd-iommu.c
+++ b/drivers/iommu/sprd-iommu.c
@@ -297,7 +297,7 @@ static int sprd_iommu_map(struct iommu_domain *domain,
unsigned long iova,
}
if (iova < start || (iova + size) > (end + 1)) {
- dev_err(dom->sdev->dev, "(iova(0x%lx) + sixe(%zx)) are not in
the range!\n",
+ dev_err(dom->sdev->dev, "(iova(0x%lx) + size(%zx)) are not in
the range!\n",
iova, size);
return -EINVAL;
}
--
2.30.2
[PATCH][next] octeontx2-pf: Fix spelling mistake "ratelimitter" -> "ratelimiter"
From: Colin Ian King
There is a spelling mistake in an error message. Fix it.
Signed-off-by: Colin Ian King
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
index 2f75cfc5a23a..21787dfc599b 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
@@ -176,7 +176,7 @@ static int otx2_tc_egress_matchall_install(struct otx2_nic
*nic,
if (nic->flags & OTX2_FLAG_TC_MATCHALL_EGRESS_ENABLED) {
NL_SET_ERR_MSG_MOD(extack,
- "Only one Egress MATCHALL ratelimitter can
be offloaded");
+ "Only one Egress MATCHALL ratelimiter can be
offloaded");
return -ENOMEM;
}
--
2.30.2
