Kernel bugs found using inspect tool

From: Rupp, Ed J (ed.rupp@compaq.com)
Date: Tue Feb 22 2000 - 15:49:16 EST


I ran the 2.3.38 distribution through a program from
the AT&T toolchest called 'inspect'. I found 10 near-certain
bugs which may or may not be causing any observable problems
and 13 probable bugs which I couldn't immediately tell if they
were just odd coding style or real errors. Most of the bugs
are in the drivers area which I guess is no suprise since these
drivers are less heavily travelled than the rest of the kernel.
I hope this is the right list to send this to.

===== BUGS ====
drivers/atm/nicstar.c: extra semicolon near line 505
         if (pci_write_config_byte(pcidev, PCI_LATENCY_TIMER,
NS_PCI_LATENCY) != 0);
drivers/cdrom/aztcd.c: extra semicolon near line 1730
                    for (count = 0; count < AZT_TIMEOUT; count++);
drivers/char/joystick/joy-creative.c: extra semicolon near line 69
        for (i = 0; i < 2; i++); {
drivers/net/acenic.c: extra semicolon near line 1090
                if (!(ap->trace_buf = kmalloc(ACE_TRACE_SIZE, GFP_KERNEL)));
drivers/net/pcmcia/netwave_cs.c: bitwise-or in conditional context near line
1319
        if ((dev == NULL) | (!dev->start))
drivers/net/tokenring/smctr.c: extra semicolon near line 2938
        for(i = 0; ((i < 6) && (dev->dev_addr[i] == 0)); i++);
drivers/scsi/53c7,8xx.c: extra semicolon near line 3152
    for (bp = (struct NCR53c7x0_break *) host->breakpoints;
drivers/sound/vidc_audio.c: extra semicolon near line 82
                for (new2size = 128; new2size < newsize; new2size <<= 1);
drivers/telephony/ixj.c: extra semicolon near line 1976
        if (ixj[board].play_mode != -1 && ixj[board].rec_mode != -1);
net/khttpd/security.c: extra semicolon near line 134
                if (filp!=NULL);

===== Questionable ====
arch/ppc/math-emu/op-4.h: comparison takes precedence over assignment near
line 215
  (x3 += ((x2 += ((x1 += ((x0 += i) < x0)) < x1) < x2)))
drivers/atm/eni.c: comparison takes precedence over assignment near line
1041
        if (!(aal5 = vcc->qos.aal == ATM_AAL5))
drivers/char/sx.c: missing logical operator near line 627
        for (i=0; i < TIMEOUT_1 > 0;i++)
drivers/char/sx.c: missing logical operator near line 633
        for (i=0; i < TIMEOUT_2 > 0;i++) {
drivers/char/sx.c: missing logical operator near line 655
        for (i=0; i < TIMEOUT_1 > 0;i++)
drivers/char/sx.c: missing logical operator near line 661
        for (i=0; i < TIMEOUT_2 > 0;i++) {
drivers/net/fc/iph5526.c: missing logical operator near line 3773
        for (i = 0; i < clone_list[i].vendor_id != 0; i++)
drivers/scsi/FlashPoint.c: bitwise-or in conditional context near line 4713
   while ((hp_int = RDW_HARPOON((ioport+hp_intstat)) & default_intena) |
drivers/scsi/advansys.c: missing logical operator near line 7684
            qdonep->remain_bytes <= scp->request_bufflen != 0) {
drivers/sound/lowlevel/aci.c: comparison takes precedence over assignment
near line 390
      return (*(int *) arg = (status & 0x20) == 0);
drivers/sound/sscape.c: comparison takes precedence over assignment near
line 603
        if (hw_config->irq > 15 || (regs[4] = irq_bits == 0xff))
drivers/video/atafb.c: comparison takes precedence over bitwise-and near
line 1198
        if (par->HDB & 0x200 && par->HDB & ~0x200 - par->HDE <= 5) {
net/decnet/af_decnet.c: comparison takes precedence over assignment near
line 1842
                if ((err = sock_error(sk) != 0))

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed Feb 23 2000 - 21:00:31 EST