Pull up following revision(s) (requested by msaitoh in ticket #672):

sys/dev/ic/tulip.c: revision 1.198
	sys/dev/pci/if_jme.c: revision 1.45
	sys/dev/pci/agp.c: revision 1.86
	sys/dev/pci/if_lii.c: revision 1.27
	sys/dev/acpi/thinkpad_acpi.c: revision 1.47
	sys/dev/scsipi/scsipi_base.c: revision 1.183
	sys/dev/ic/aic6915reg.h: revision 1.6

 Fix undefined behavior in thinkpad_mask_init(). Found by kUBSan.

 Use unsigned when initialize the transmit completion ring to avoid undefined
behavior. Found by kUBSan.

Avoid undefined behavior when setting multicast address. found by kUBSan.

 Use unsigned to avoid undefined behavior in agpattach(). Found by kUBSan.

 Avoid undefined behavior in jme_mii_write(). Found by kUBSan.

 Use unsigned to avoid undefined behavior in lii_setmulti().

 Use unsigned to avoid undefined behavior in scsipi_{get,put}_tag().

Found by kUBSan.
This commit is contained in:
martin 2020-01-31 11:17:32 +00:00
parent c4f46ec221
commit 746021a2fe
7 changed files with 25 additions and 24 deletions

View File

@ -1,4 +1,4 @@
/* $NetBSD: thinkpad_acpi.c,v 1.46 2016/04/03 10:36:00 mlelstv Exp $ */
/* $NetBSD: thinkpad_acpi.c,v 1.46.24.1 2020/01/31 11:17:32 martin Exp $ */
/*-
* Copyright (c) 2007 Jared D. McNeill <jmcneill@invisible.ca>
@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: thinkpad_acpi.c,v 1.46 2016/04/03 10:36:00 mlelstv Exp $");
__KERNEL_RCSID(0, "$NetBSD: thinkpad_acpi.c,v 1.46.24.1 2020/01/31 11:17:32 martin Exp $");
#include <sys/param.h>
#include <sys/device.h>
@ -565,7 +565,7 @@ thinkpad_mask_init(thinkpad_softc_t *sc, uint32_t mask)
for (i = 0; i < 32; i++) {
param[0].Integer.Value = i + 1;
param[1].Integer.Value = (((1 << i) & mask) != 0);
param[1].Integer.Value = ((__BIT(i) & mask) != 0);
rv = AcpiEvaluateObject(sc->sc_node->ad_handle, "MHKM",
&params, NULL);

View File

@ -1,4 +1,4 @@
/* $NetBSD: aic6915reg.h,v 1.5 2008/04/28 20:23:49 martin Exp $ */
/* $NetBSD: aic6915reg.h,v 1.5.94.1 2020/01/31 11:17:32 martin Exp $ */
/*-
* Copyright (c) 2001 The NetBSD Foundation, Inc.
@ -194,7 +194,7 @@ struct sf_tcd {
uint32_t tcd_word0; /* index, priority, flags */
};
#define TCD_DMA_ID (0x4 << 29)
#define TCD_DMA_ID (0x4U << 29)
#define TCD_INDEX(x) ((x) & 0x7fff)
#define TCD_PR (1U << 15)
#define TCD_TIMESTAMP(x) (((x) >> 16) & 0x1fff)

View File

@ -1,4 +1,4 @@
/* $NetBSD: tulip.c,v 1.197 2019/05/28 08:59:34 msaitoh Exp $ */
/* $NetBSD: tulip.c,v 1.197.2.1 2020/01/31 11:17:32 martin Exp $ */
/*-
* Copyright (c) 1998, 1999, 2000, 2002 The NetBSD Foundation, Inc.
@ -36,7 +36,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: tulip.c,v 1.197 2019/05/28 08:59:34 msaitoh Exp $");
__KERNEL_RCSID(0, "$NetBSD: tulip.c,v 1.197.2.1 2020/01/31 11:17:32 martin Exp $");
#include <sys/param.h>
@ -2943,7 +2943,7 @@ tlp_al981_filter_setup(struct tulip_softc *sc)
}
hash = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN) & 0x3f;
mchash[hash >> 5] |= 1 << (hash & 0x1f);
mchash[hash >> 5] |= __BIT(hash & 0x1f);
ETHER_NEXT_MULTI(step, enm);
}
ETHER_UNLOCK(ec);

View File

@ -1,4 +1,4 @@
/* $NetBSD: agp.c,v 1.85 2018/08/27 07:34:54 riastradh Exp $ */
/* $NetBSD: agp.c,v 1.85.6.1 2020/01/31 11:17:32 martin Exp $ */
/*-
* Copyright (c) 2000 Doug Rabson
@ -65,7 +65,7 @@
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: agp.c,v 1.85 2018/08/27 07:34:54 riastradh Exp $");
__KERNEL_RCSID(0, "$NetBSD: agp.c,v 1.85.6.1 2020/01/31 11:17:32 martin Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -312,7 +312,7 @@ agpmatch(device_t parent, cfdata_t match, void *aux)
return (1);
}
static const int agp_max[][2] = {
static const u_int agp_max[][2] = {
{0, 0},
{32, 4},
{64, 28},
@ -332,7 +332,8 @@ agpattach(device_t parent, device_t self, void *aux)
struct pci_attach_args *pa = &apa->apa_pci_args;
struct agp_softc *sc = device_private(self);
const struct agp_product *ap;
int memsize, i, ret;
int ret;
u_int memsize, i;
ap = agp_lookup(pa);
KASSERT(ap != NULL);

View File

@ -1,4 +1,4 @@
/* $NetBSD: if_jme.c,v 1.44.2.1 2019/10/24 16:25:33 martin Exp $ */
/* $NetBSD: if_jme.c,v 1.44.2.2 2020/01/31 11:17:32 martin Exp $ */
/*
* Copyright (c) 2008 Manuel Bouyer. All rights reserved.
@ -58,7 +58,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: if_jme.c,v 1.44.2.1 2019/10/24 16:25:33 martin Exp $");
__KERNEL_RCSID(0, "$NetBSD: if_jme.c,v 1.44.2.2 2020/01/31 11:17:32 martin Exp $");
#include <sys/param.h>
@ -1021,7 +1021,7 @@ jme_mii_write(device_t self, int phy, int reg, uint16_t val)
bus_space_write_4(sc->jme_bt_mac, sc->jme_bh_mac, JME_SMI,
SMI_OP_WRITE | SMI_OP_EXECUTE |
((val << SMI_DATA_SHIFT) & SMI_DATA_MASK) |
(((uint32_t)val << SMI_DATA_SHIFT) & SMI_DATA_MASK) |
SMI_PHY_ADDR(phy) | SMI_REG_ADDR(reg));
for (i = JME_PHY_TIMEOUT / 10; i > 0; i--) {
delay(10);

View File

@ -1,4 +1,4 @@
/* $NetBSD: if_lii.c,v 1.26 2019/05/30 02:32:18 msaitoh Exp $ */
/* $NetBSD: if_lii.c,v 1.26.2.1 2020/01/31 11:17:32 martin Exp $ */
/*
* Copyright (c) 2008 The NetBSD Foundation.
@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: if_lii.c,v 1.26 2019/05/30 02:32:18 msaitoh Exp $");
__KERNEL_RCSID(0, "$NetBSD: if_lii.c,v 1.26.2.1 2020/01/31 11:17:32 martin Exp $");
#include <sys/param.h>
@ -1186,10 +1186,10 @@ lii_setmulti(struct lii_softc *sc)
crc = ether_crc32_be(enm->enm_addrlo, ETHER_ADDR_LEN);
if (crc & (1 << 31))
mht1 |= (1 << ((crc >> 26) & 0x0000001f));
if (crc & (1U << 31))
mht1 |= (1U << ((crc >> 26) & 0x0000001f));
else
mht0 |= (1 << ((crc >> 26) & 0x0000001f));
mht0 |= (1U << ((crc >> 26) & 0x0000001f));
ETHER_NEXT_MULTI(step, enm);
}

View File

@ -1,4 +1,4 @@
/* $NetBSD: scsipi_base.c,v 1.182 2019/03/28 10:44:29 kardel Exp $ */
/* $NetBSD: scsipi_base.c,v 1.182.4.1 2020/01/31 11:17:32 martin Exp $ */
/*-
* Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: scsipi_base.c,v 1.182 2019/03/28 10:44:29 kardel Exp $");
__KERNEL_RCSID(0, "$NetBSD: scsipi_base.c,v 1.182.4.1 2020/01/31 11:17:32 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_scsi.h"
@ -367,7 +367,7 @@ scsipi_get_tag(struct scsipi_xfer *xs)
#endif
bit -= 1;
periph->periph_freetags[word] &= ~(1 << bit);
periph->periph_freetags[word] &= ~(1U << bit);
tag = (word << 5) | bit;
/* XXX Should eventually disallow this completely. */
@ -398,7 +398,7 @@ scsipi_put_tag(struct scsipi_xfer *xs)
word = xs->xs_tag_id >> 5;
bit = xs->xs_tag_id & 0x1f;
periph->periph_freetags[word] |= (1 << bit);
periph->periph_freetags[word] |= (1U << bit);
}
/*