* [axboe:rw_iter 407/469] drivers/media/rc/imon.c:982 vfd_write() warn: potential spectre issue 'ictx->tx.data_buf' [w] (local cap)
@ 2026-03-18 15:59 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-03-18 15:59 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Jens Axboe <axboe@kernel.dk>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git rw_iter
head: 62678cb3ae1da26563d6ccca83852ce4826f683e
commit: 4315aded538749a5f15097dc1c91a6759360193a [407/469] media/rc: convert to read/write iterators
:::::: branch date: 13 hours ago
:::::: commit date: 13 hours ago
config: i386-randconfig-141-20260318 (https://download.01.org/0day-ci/archive/20260318/202603182333.VCIt4zxW-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202603182333.VCIt4zxW-lkp@intel.com/
smatch warnings:
drivers/media/rc/imon.c:982 vfd_write() warn: potential spectre issue 'ictx->tx.data_buf' [w] (local cap)
vim +982 drivers/media/rc/imon.c
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 932
255940e642387f drivers/media/rc/imon.c Mauro Carvalho Chehab 2017-11-27 933 /*
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 934 * Writes data to the VFD. The iMON VFD is 2x16 characters
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 935 * and requires data in 5 consecutive USB interrupt packets,
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 936 * each packet but the last carrying 7 bytes.
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 937 *
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 938 * I don't know if the VFD board supports features such as
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 939 * scrolling, clearing rows, blanking, etc. so at
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 940 * the caller must provide a full screen of data. If fewer
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 941 * than 32 bytes are provided spaces will be appended to
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 942 * generate a full screen.
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 943 */
4315aded538749 drivers/media/rc/imon.c Jens Axboe 2024-04-09 944 static ssize_t vfd_write(struct kiocb *iocb, struct iov_iter *from)
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 945 {
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 946 int i;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 947 int offset;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 948 int seq;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 949 int retval = 0;
4315aded538749 drivers/media/rc/imon.c Jens Axboe 2024-04-09 950 struct imon_context *ictx = iocb->ki_filp->private_data;
c25895c7d6c957 drivers/media/rc/imon.c Colin Ian King 2017-09-05 951 static const unsigned char vfd_packet6[] = {
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 952 0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF };
4315aded538749 drivers/media/rc/imon.c Jens Axboe 2024-04-09 953 size_t n_bytes = iov_iter_count(from);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 954
813ceef062b53d drivers/media/rc/imon.c Gautam Menghani 2022-10-19 955 if (mutex_lock_interruptible(&ictx->lock))
813ceef062b53d drivers/media/rc/imon.c Gautam Menghani 2022-10-19 956 return -ERESTARTSYS;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 957
fa0f61cc1d8281 drivers/media/rc/imon.c Larshin Sergey 2025-07-29 958 if (ictx->disconnected) {
fa0f61cc1d8281 drivers/media/rc/imon.c Larshin Sergey 2025-07-29 959 retval = -ENODEV;
fa0f61cc1d8281 drivers/media/rc/imon.c Larshin Sergey 2025-07-29 960 goto exit;
fa0f61cc1d8281 drivers/media/rc/imon.c Larshin Sergey 2025-07-29 961 }
fa0f61cc1d8281 drivers/media/rc/imon.c Larshin Sergey 2025-07-29 962
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 963 if (!ictx->dev_present_intf0) {
47a09b082f7050 drivers/media/rc/imon.c Jarod Wilson 2011-07-14 964 pr_err_ratelimited("no iMON device present\n");
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 965 retval = -ENODEV;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 966 goto exit;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 967 }
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 968
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 969 if (n_bytes <= 0 || n_bytes > 32) {
47a09b082f7050 drivers/media/rc/imon.c Jarod Wilson 2011-07-14 970 pr_err_ratelimited("invalid payload size\n");
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 971 retval = -EINVAL;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 972 goto exit;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 973 }
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 974
4315aded538749 drivers/media/rc/imon.c Jens Axboe 2024-04-09 975 if (!copy_from_iter_full(ictx->tx.data_buf, n_bytes, from)) {
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 976 retval = -EFAULT;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 977 goto exit;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 978 }
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 979
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 980 /* Pad with spaces */
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 981 for (i = n_bytes; i < 32; ++i)
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 @982 ictx->tx.data_buf[i] = ' ';
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 983
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 984 for (i = 32; i < 35; ++i)
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 985 ictx->tx.data_buf[i] = 0xFF;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 986
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 987 offset = 0;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 988 seq = 0;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 989
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 990 do {
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 991 memcpy(ictx->usb_tx_buf, ictx->tx.data_buf + offset, 7);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 992 ictx->usb_tx_buf[7] = (unsigned char) seq;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 993
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 994 retval = send_packet(ictx);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 995 if (retval) {
47a09b082f7050 drivers/media/rc/imon.c Jarod Wilson 2011-07-14 996 pr_err_ratelimited("send packet #%d failed\n", seq / 2);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 997 goto exit;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 998 } else {
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 999 seq += 2;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1000 offset += 7;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1001 }
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1002
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1003 } while (offset < 35);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1004
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1005 /* Send packet #6 */
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1006 memcpy(ictx->usb_tx_buf, &vfd_packet6, sizeof(vfd_packet6));
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1007 ictx->usb_tx_buf[7] = (unsigned char) seq;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1008 retval = send_packet(ictx);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1009 if (retval)
47a09b082f7050 drivers/media/rc/imon.c Jarod Wilson 2011-07-14 1010 pr_err_ratelimited("send packet #%d failed\n", seq / 2);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1011
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1012 exit:
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1013 mutex_unlock(&ictx->lock);
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1014
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1015 return (!retval) ? n_bytes : retval;
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1016 }
21677cfc562a27 drivers/media/IR/imon.c Jarod Wilson 2010-04-16 1017
:::::: The code at line 982 was first introduced by commit
:::::: 21677cfc562a27e099719d413287bc8d1d24deb7 V4L/DVB: ir-core: add imon driver
:::::: TO: Jarod Wilson <jarod@redhat.com>
:::::: CC: Mauro Carvalho Chehab <mchehab@redhat.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-03-18 16:00 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-18 15:59 [axboe:rw_iter 407/469] drivers/media/rc/imon.c:982 vfd_write() warn: potential spectre issue 'ictx->tx.data_buf' [w] (local cap) kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.