drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
kernel test robot <[email protected]>
| Newsgroups | dev.linux.lists.oe-kbuild |
|---|---|
| Message-ID | <[email protected]> |
BCC: [email protected] CC: [email protected] CC: [email protected] TO: Marco Elver <[email protected]> CC: "Vlastimil Babka (SUSE)" <[email protected]> CC: "Harry Yoo (Oracle)" <[email protected]> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 44696aa3a489d2baf58efa61b37833f100072bee commit: feb662d9168b63e1d4c02671ec96005410c6f3ce slab: support for compiler-assisted type-based slab cache partitioning date: 9 weeks ago :::::: branch date: 27 hours ago :::::: commit date: 9 weeks ago config: i386-randconfig-r071-20260713 (https://download.01.org/0day-ci/archive/20260713/[email protected]/config) compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211) smatch: v0.5.0-9185-gbcc58b9c If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning") | Reported-by: kernel test robot <[email protected]> | Reported-by: Dan Carpenter <[email protected]> | Closes: https://lore.kernel.org/r/[email protected]/ smatch warnings: drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max' drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max' vim +285 drivers/platform/chrome/cros_ec_chardev.c 96a0a80738461d Enric Balletbo i Serra 2019-09-02 268 eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 269 /* eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 270 * Ioctls eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 271 */ 032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 272 static long cros_ec_chardev_ioctl_xcmd(struct chardev_priv *priv, void __user *arg) eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 273 { eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 274 struct cros_ec_command *s_cmd; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 275 struct cros_ec_command u_cmd; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 276 long ret; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 277 eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 278 if (copy_from_user(&u_cmd, arg, sizeof(u_cmd))) eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 279 return -EFAULT; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 280 eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 281 if (u_cmd.outsize > EC_MAX_MSG_BYTES || eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 282 u_cmd.insize > EC_MAX_MSG_BYTES) eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 283 return -EINVAL; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 284 b20cf3f89c56b5 Tzung-Bi Shih 2023-03-24 @285 s_cmd = kzalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize), eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 286 GFP_KERNEL); eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 287 if (!s_cmd) eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 288 return -ENOMEM; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 289 eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 290 if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + u_cmd.outsize)) { eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 291 ret = -EFAULT; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 292 goto exit; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 293 } eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 294 eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 295 if (u_cmd.outsize != s_cmd->outsize || eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 296 u_cmd.insize != s_cmd->insize) { eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 297 ret = -EINVAL; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 298 goto exit; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 299 } eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 300 032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 301 s_cmd->command += priv->cmd_offset; 032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 302 ret = cros_ec_cmd_xfer(priv->ec_dev, s_cmd); eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 303 /* Only copy data to userland if data was received. */ eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 304 if (ret < 0) eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 305 goto exit; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 306 eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 307 if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize)) eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 308 ret = -EFAULT; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 309 exit: eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 310 kfree(s_cmd); eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 311 return ret; eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 312 } eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 313 :::::: The code at line 285 was first introduced by commit :::::: b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl :::::: TO: Tzung-Bi Shih <[email protected]> :::::: CC: Tzung-Bi Shih <[email protected]> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki