Smatch reports for drivers/scsi/scsi.c
Andrew Goodbody
andrew.goodbody at linaro.org
Wed Jul 2 15:45:48 CEST 2025
Hi,
Smatch reports the following for drivers/scsi/scsi.c
drivers/scsi/scsi.c:165 scsi_setup_erase_ext() warn: right shifting more
than type allows 16 vs 24
drivers/scsi/scsi.c:166 scsi_setup_erase_ext() warn: right shifting more
than type allows 16 vs 16
I just wanted some ideas on the best way to resolve this. There are
differing patterns even within this file about how the number of blocks
parameter should be handled in calls to static functions. In all cases
the value starts as a lbaint_t which can be a long or a 64 bit type.
1) in scsi_read there are calls to scsi_setup_read_ext whose third
parameter is an unsigned short. The lbaint_t variable is assigned to an
unsigned short (smallblks), which will simply truncate the value, before
smallblks is passed as the 3rd parameter to scsi_setup_read_ext.
In scsi_setup_read_ext the third parameter (blocks) is split into 2
bytes. A third byte is set to 0 and I am guessing that if appropriate
this could have taken a higher order byte if that had made sense.
2) scsi_write is similar to scsi_read
3) scsi_erase calls scsi_setup_erase_ext with lbaint_t as the third
parameter. scsi_setup_erase_ext takes unsigned short so there is an
implicit truncation here. Here is where Smatch complains as this
unsigned short is shifted 16 or 24 bits to the right, both of which
exceed the size of this type.
So possible fixes are to make all three functions consistent and take an
lbaint_t as the third parameter. Or to make scsi_setup_erase_ext like
the other two and just hard code those bytes with excessive shifts to be
0. Can probably remove the use of the smallblks variable at the same time.
Suggestions?
Andrew
More information about the U-Boot
mailing list