From: kernel test robot <lkp@intel.com>
To: kbuild@lists.01.org
Subject: Re: [PATCH] firewire: prevent integer overflow on 32bit systems
Date: Wed, 03 Mar 2021 22:10:37 +0800 [thread overview]
Message-ID: <202103032246.BnnnQBV4-lkp@intel.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 7817 bytes --]
CC: kbuild-all(a)lists.01.org
In-Reply-To: <YD4e9XOD8JPlJzxW@mwanda>
References: <YD4e9XOD8JPlJzxW@mwanda>
TO: Dan Carpenter <error27@gmail.com>
TO: Stefan Richter <stefanr@s5r6.in-berlin.de>
CC: linux1394-devel(a)lists.sourceforge.net
CC: linux-kernel(a)vger.kernel.org
CC: kernel-janitors(a)vger.kernel.org
Hi Dan,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on linux/master]
[also build test WARNING on linus/master v5.12-rc1 next-20210303]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Dan-Carpenter/firewire-prevent-integer-overflow-on-32bit-systems/20210303-201128
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2ab38c17aac10bf55ab3efde4c4db3893d8691d2
:::::: branch date: 2 hours ago
:::::: commit date: 2 hours ago
config: x86_64-randconfig-m001-20210303 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/firewire/core-cdev.c:590 init_request() warn: impossible condition '(request->length > (~0) - 296) => (0-u32max > 18446744073709551319)'
vim +590 drivers/firewire/core-cdev.c
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 574
acfe8333572cad5d drivers/firewire/fw-cdev.c Jay Fenlason, Stefan Richter 2009-01-04 575 static int init_request(struct client *client,
acfe8333572cad5d drivers/firewire/fw-cdev.c Jay Fenlason, Stefan Richter 2009-01-04 576 struct fw_cdev_send_request *request,
acfe8333572cad5d drivers/firewire/fw-cdev.c Jay Fenlason, Stefan Richter 2009-01-04 577 int destination_id, int speed)
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 578 {
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 579 struct outbound_transaction_event *e;
1f3125af8ed7410c drivers/firewire/fw-cdev.c Stefan Richter 2008-12-05 580 int ret;
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 581
18e9b10fcdc090d3 drivers/firewire/fw-cdev.c Stefan Richter 2009-03-10 582 if (request->tcode != TCODE_STREAM_DATA &&
18e9b10fcdc090d3 drivers/firewire/fw-cdev.c Stefan Richter 2009-03-10 583 (request->length > 4096 || request->length > 512 << speed))
5d3fd692a7196a90 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 584 return -EIO;
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 585
a8e93f3dccc066cd drivers/firewire/core-cdev.c Clemens Ladisch 2010-07-07 586 if (request->tcode == TCODE_WRITE_QUADLET_REQUEST &&
a8e93f3dccc066cd drivers/firewire/core-cdev.c Clemens Ladisch 2010-07-07 587 request->length < 4)
a8e93f3dccc066cd drivers/firewire/core-cdev.c Clemens Ladisch 2010-07-07 588 return -EINVAL;
a8e93f3dccc066cd drivers/firewire/core-cdev.c Clemens Ladisch 2010-07-07 589
4571db3d737ee053 drivers/firewire/core-cdev.c Dan Carpenter 2021-03-02 @590 if (request->length > ULONG_MAX - sizeof(*e))
4571db3d737ee053 drivers/firewire/core-cdev.c Dan Carpenter 2021-03-02 591 return -EINVAL;
4571db3d737ee053 drivers/firewire/core-cdev.c Dan Carpenter 2021-03-02 592
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 593 e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL);
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 594 if (e == NULL)
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 595 return -ENOMEM;
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 596
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 597 e->client = client;
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 598 e->response.length = request->length;
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 599 e->response.closure = request->closure;
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 600
4f2592232ea951e5 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2007-04-30 601 if (request->data &&
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 602 copy_from_user(e->response.data,
4f2592232ea951e5 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2007-04-30 603 u64_to_uptr(request->data), request->length)) {
1f3125af8ed7410c drivers/firewire/fw-cdev.c Stefan Richter 2008-12-05 604 ret = -EFAULT;
45ee3199eb3e4233 drivers/firewire/fw-cdev.c Jay Fenlason 2008-12-21 605 goto failed;
1f3125af8ed7410c drivers/firewire/fw-cdev.c Stefan Richter 2008-12-05 606 }
1f3125af8ed7410c drivers/firewire/fw-cdev.c Stefan Richter 2008-12-05 607
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 608 e->r.resource.release = release_transaction;
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 609 ret = add_client_resource(client, &e->r.resource, GFP_KERNEL);
45ee3199eb3e4233 drivers/firewire/fw-cdev.c Jay Fenlason 2008-12-21 610 if (ret < 0)
45ee3199eb3e4233 drivers/firewire/fw-cdev.c Jay Fenlason 2008-12-21 611 goto failed;
28cf6a04c82857d5 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2007-03-07 612
acfe8333572cad5d drivers/firewire/fw-cdev.c Jay Fenlason, Stefan Richter 2009-01-04 613 fw_send_request(client->device->card, &e->r.transaction,
664d8010b170ae8b drivers/firewire/fw-cdev.c Stefan Richter 2009-03-10 614 request->tcode, destination_id, request->generation,
664d8010b170ae8b drivers/firewire/fw-cdev.c Stefan Richter 2009-03-10 615 speed, request->offset, e->response.data,
664d8010b170ae8b drivers/firewire/fw-cdev.c Stefan Richter 2009-03-10 616 request->length, complete_transaction, e);
664d8010b170ae8b drivers/firewire/fw-cdev.c Stefan Richter 2009-03-10 617 return 0;
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 618
45ee3199eb3e4233 drivers/firewire/fw-cdev.c Jay Fenlason 2008-12-21 619 failed:
97c18b7fd6df4ae0 drivers/firewire/fw-cdev.c Stefan Richter 2009-01-04 620 kfree(e);
1f3125af8ed7410c drivers/firewire/fw-cdev.c Stefan Richter 2008-12-05 621
1f3125af8ed7410c drivers/firewire/fw-cdev.c Stefan Richter 2008-12-05 622 return ret;
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 623 }
19a15b937b266389 drivers/firewire/fw-device-cdev.c Kristian Høgsberg 2006-12-19 624
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 36605 bytes --]
next reply other threads:[~2021-03-03 14:10 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-03 14:10 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2021-03-02 11:18 [PATCH] firewire: prevent integer overflow on 32bit systems Dan Carpenter
2021-03-02 21:19 ` Stefan Richter
2021-03-03 5:22 ` Dan Carpenter
2021-03-03 17:31 ` kernel test robot
2021-03-03 17:31 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202103032246.BnnnQBV4-lkp@intel.com \
--to=lkp@intel.com \
--cc=kbuild@lists.01.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.