From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [intel-lts:4.19/android_s 677/30000] drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
Date: Fri, 20 Sep 2024 12:07:34 +0800 [thread overview]
Message-ID: <202409201214.doUEuMvs-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Meng Wei <wei.meng@intel.com>
CC: "Pan, Kris" <kris.pan@intel.com>
CC: Chang Ying <ying.chang@intel.com>
tree: https://github.com/intel/linux-intel-lts.git 4.19/android_s
head: 84d5fc421289417e51781e27e64fbb0fc44216ae
commit: dcdab0d72b69b6291d08483c0baf62cf92e2a1bc [677/30000] v4l: subdev: Add [GS]_ROUTING subdev ioctls and operations
:::::: branch date: 2 weeks ago
:::::: commit date: 5 years ago
config: x86_64-randconfig-161-20240914 (https://download.01.org/0day-ci/archive/20240920/202409201214.doUEuMvs-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202409201214.doUEuMvs-lkp@intel.com/
smatch warnings:
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
vim +/num_routes +1098 drivers/media/v4l2-core/v4l2-compat-ioctl32.c
dcdab0d72b69b6 Meng Wei 2018-10-26 1081
dcdab0d72b69b6 Meng Wei 2018-10-26 1082 static int put_v4l2_subdev_routing(struct v4l2_subdev_routing __user *kp,
dcdab0d72b69b6 Meng Wei 2018-10-26 1083 struct v4l2_subdev_routing32 __user *up)
dcdab0d72b69b6 Meng Wei 2018-10-26 1084 {
dcdab0d72b69b6 Meng Wei 2018-10-26 1085 struct v4l2_subdev_route __user *uroutes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1086 compat_caddr_t p;
dcdab0d72b69b6 Meng Wei 2018-10-26 1087 u32 num_routes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1088
dcdab0d72b69b6 Meng Wei 2018-10-26 1089 if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1090 get_user(p, &up->routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1091 get_user(num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1092 assign_in_user(&up->num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1093 !access_ok(VERIFY_WRITE, up->reserved, sizeof(*up->reserved)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1094 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1095
dcdab0d72b69b6 Meng Wei 2018-10-26 1096 uroutes = compat_ptr(p);
dcdab0d72b69b6 Meng Wei 2018-10-26 1097
dcdab0d72b69b6 Meng Wei 2018-10-26 @1098 if (!access_ok(VERIFY_WRITE, uroutes,
dcdab0d72b69b6 Meng Wei 2018-10-26 1099 num_routes * sizeof(*kp->routes)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1100 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1101
dcdab0d72b69b6 Meng Wei 2018-10-26 1102 return 0;
dcdab0d72b69b6 Meng Wei 2018-10-26 1103 }
dcdab0d72b69b6 Meng Wei 2018-10-26 1104
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2024-09-20 4:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-20 4:07 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-09-25 8:04 [intel-lts:4.19/android_s 677/30000] drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes' Dan Carpenter
2024-09-16 7:41 Dan Carpenter
2024-09-16 4:40 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202409201214.doUEuMvs-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.