[android-common:android12-5.4 5/9] drivers/dma-buf/heaps/system_heap.c:351 system_heap_buf_free() error: buffer overflow 'pools' 3 <= 3 (assuming for loop doesn't break)

[Dan Carpenter <dan.carpenter@oracle.com>]

[-- Attachment #1: Type: text/plain, Size: 3385 bytes --]

tree:   https://android.googlesource.com/kernel/common  android12-5.4
head:   82c67a98c7494b4e71dcbea03335509e9ccecfa5
commit: e3919bfeb0066ab9b5f9765e5610b95672990e64 [5/9] ANDROID: dma-buf: system_heap: Add deferred freeing to the system heap
config: x86_64-randconfig-m001-20210301 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/dma-buf/heaps/system_heap.c:351 system_heap_buf_free() error: buffer overflow 'pools' 3 <= 3 (assuming for loop doesn't break)

vim +351 drivers/dma-buf/heaps/system_heap.c

e3919bfeb0066a John Stultz 2020-12-09  326  static void system_heap_buf_free(struct deferred_freelist_item *item,
e3919bfeb0066a John Stultz 2020-12-09  327  				 enum df_reason reason)
fc004422dadc12 John Stultz 2020-09-25  328  {
e3919bfeb0066a John Stultz 2020-12-09  329  	struct system_heap_buffer *buffer;
fc004422dadc12 John Stultz 2020-09-25  330  	struct sg_table *table;
fc004422dadc12 John Stultz 2020-09-25  331  	struct scatterlist *sg;
44008f99d9ca07 John Stultz 2019-06-06  332  	int i, j;
44008f99d9ca07 John Stultz 2019-06-06  333  
e3919bfeb0066a John Stultz 2020-12-09  334  	buffer = container_of(item, struct system_heap_buffer, deferred_free);
44008f99d9ca07 John Stultz 2019-06-06  335  	/* Zero the buffer pages before adding back to the pool */
e3919bfeb0066a John Stultz 2020-12-09  336  	if (reason == DF_NORMAL)
e3919bfeb0066a John Stultz 2020-12-09  337  		if (system_heap_zero_buffer(buffer))
e3919bfeb0066a John Stultz 2020-12-09  338  			reason = DF_UNDER_PRESSURE; // On failure, just free
fc004422dadc12 John Stultz 2020-09-25  339  
fc004422dadc12 John Stultz 2020-09-25  340  	table = &buffer->sg_table;
703f43c5810e08 John Stultz 2020-09-26  341  	for_each_sg(table->sgl, sg, table->nents, i) {
703f43c5810e08 John Stultz 2020-09-26  342  		struct page *page = sg_page(sg);
703f43c5810e08 John Stultz 2020-09-26  343  
e3919bfeb0066a John Stultz 2020-12-09  344  		if (reason == DF_UNDER_PRESSURE) {
e3919bfeb0066a John Stultz 2020-12-09  345  			__free_pages(page, compound_order(page));
e3919bfeb0066a John Stultz 2020-12-09  346  		} else {
44008f99d9ca07 John Stultz 2019-06-06  347  			for (j = 0; j < NUM_ORDERS; j++) {
44008f99d9ca07 John Stultz 2019-06-06  348  				if (compound_order(page) == orders[j])
44008f99d9ca07 John Stultz 2019-06-06  349  					break;
44008f99d9ca07 John Stultz 2019-06-06  350  			}
44008f99d9ca07 John Stultz 2019-06-06 @351  			dmabuf_page_pool_free(pools[j], page);
                                                                                      ^^^^^^^^
Can we exit the loop with j == NUM_ORDERS?

703f43c5810e08 John Stultz 2020-09-26  352  		}
e3919bfeb0066a John Stultz 2020-12-09  353  	}
fc004422dadc12 John Stultz 2020-09-25  354  	sg_free_table(table);
c02e6ccc5a4aab John Stultz 2019-12-03  355  	kfree(buffer);
c02e6ccc5a4aab John Stultz 2019-12-03  356  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org 

_______________________________________________
kbuild mailing list -- kbuild(a)lists.01.org
To unsubscribe send an email to kbuild-leave@lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 29382 bytes --]