drivers/xen/gntdev-dmabuf.c:743 gntdev_ioctl_dmabuf_exp_from_refs() warn: potential user controlled sizeof overflow '4 * op.count' '4 * 0-u32max'

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Marco Elver <[email protected]>
CC: "Vlastimil Babka (SUSE)" <[email protected]>
CC: "Harry Yoo (Oracle)" <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   02dc699f83d04069fdabc996fc22d47cda47a4a9
commit: feb662d9168b63e1d4c02671ec96005410c6f3ce slab: support for compiler-assisted type-based slab cache partitioning
date:   3 months ago
:::::: branch date: 31 hours ago
:::::: commit date: 3 months ago
config: i386-randconfig-r072-20260802 (https://download.01.org/0day-ci/archive/20260802/[email protected]/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
drivers/xen/gntdev-dmabuf.c:743 gntdev_ioctl_dmabuf_exp_from_refs() warn: potential user controlled sizeof overflow '4 * op.count' '4 * 0-u32max'

Old smatch warnings:
drivers/xen/gntdev-dmabuf.c:793 gntdev_ioctl_dmabuf_imp_to_refs() warn: potential user controlled sizeof overflow '4 * op.count' '4 * 0-u32max'

vim +743 drivers/xen/gntdev-dmabuf.c

932d6562179efe Oleksandr Andrushchenko 2018-07-20  720  
2ea7a5bcc4cfca Juergen Gross           2025-08-26  721  long gntdev_ioctl_dmabuf_exp_from_refs(struct gntdev_priv *priv,
932d6562179efe Oleksandr Andrushchenko 2018-07-20  722  				       struct ioctl_gntdev_dmabuf_exp_from_refs __user *u)
932d6562179efe Oleksandr Andrushchenko 2018-07-20  723  {
932d6562179efe Oleksandr Andrushchenko 2018-07-20  724  	struct ioctl_gntdev_dmabuf_exp_from_refs op;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  725  	u32 *refs;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  726  	long ret;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  727  
2ea7a5bcc4cfca Juergen Gross           2025-08-26  728  	if (xen_pv_domain()) {
2ea7a5bcc4cfca Juergen Gross           2025-08-26  729  		pr_debug("Cannot provide dma-buf in a PV domain\n");
932d6562179efe Oleksandr Andrushchenko 2018-07-20  730  		return -EINVAL;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  731  	}
932d6562179efe Oleksandr Andrushchenko 2018-07-20  732  
932d6562179efe Oleksandr Andrushchenko 2018-07-20  733  	if (copy_from_user(&op, u, sizeof(op)) != 0)
932d6562179efe Oleksandr Andrushchenko 2018-07-20  734  		return -EFAULT;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  735  
3b06ac6707c196 Juergen Gross           2019-11-07  736  	if (unlikely(gntdev_test_page_count(op.count)))
932d6562179efe Oleksandr Andrushchenko 2018-07-20  737  		return -EINVAL;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  738  
932d6562179efe Oleksandr Andrushchenko 2018-07-20  739  	refs = kcalloc(op.count, sizeof(*refs), GFP_KERNEL);
932d6562179efe Oleksandr Andrushchenko 2018-07-20  740  	if (!refs)
932d6562179efe Oleksandr Andrushchenko 2018-07-20  741  		return -ENOMEM;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  742  
932d6562179efe Oleksandr Andrushchenko 2018-07-20 @743  	if (copy_from_user(refs, u->refs, sizeof(*refs) * op.count) != 0) {
932d6562179efe Oleksandr Andrushchenko 2018-07-20  744  		ret = -EFAULT;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  745  		goto out;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  746  	}
932d6562179efe Oleksandr Andrushchenko 2018-07-20  747  
932d6562179efe Oleksandr Andrushchenko 2018-07-20  748  	ret = dmabuf_exp_from_refs(priv, op.flags, op.count,
932d6562179efe Oleksandr Andrushchenko 2018-07-20  749  				   op.domid, refs, &op.fd);
932d6562179efe Oleksandr Andrushchenko 2018-07-20  750  	if (ret)
932d6562179efe Oleksandr Andrushchenko 2018-07-20  751  		goto out;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  752  
932d6562179efe Oleksandr Andrushchenko 2018-07-20  753  	if (copy_to_user(u, &op, sizeof(op)) != 0)
932d6562179efe Oleksandr Andrushchenko 2018-07-20  754  		ret = -EFAULT;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  755  
932d6562179efe Oleksandr Andrushchenko 2018-07-20  756  out:
932d6562179efe Oleksandr Andrushchenko 2018-07-20  757  	kfree(refs);
932d6562179efe Oleksandr Andrushchenko 2018-07-20  758  	return ret;
932d6562179efe Oleksandr Andrushchenko 2018-07-20  759  }
932d6562179efe Oleksandr Andrushchenko 2018-07-20  760  

:::::: The code at line 743 was first introduced by commit
:::::: 932d6562179efe8e2460a0343dbe0fcacf288a9e xen/gntdev: Add initial support for dma-buf UAPI

:::::: TO: Oleksandr Andrushchenko <[email protected]>
:::::: CC: Boris Ostrovsky <[email protected]>

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki