[hare-nvme:dhchap-keyring.v3 2/8] drivers/nvme/common/keyring.c:430 nvme_dhchap_psk_read() warn: unsigned 'keylen' is never less than zero.

[hare-nvme:dhchap-keyring.v3 2/8] drivers/nvme/common/keyring.c:430 nvme_dhchap_psk_read() warn: unsigned 'keylen' is never less than zero.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/hare/nvme.git dhchap-keyring.v3
head:   7ffdb5e32339cf1e1ba50b8caefaca6dbab4d882
commit: 04e4f1368f8ff23feef8b02cba8c03732228faa7 [2/8] nvme-keyring: add 'dhchap' key type
config: i386-randconfig-141-20260320 (https://download.01.org/0day-ci/archive/20260320/202603202247.phD8CbPN-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9004-gb810ac53

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603202247.phD8CbPN-lkp@intel.com/

smatch warnings:
drivers/nvme/common/keyring.c:430 nvme_dhchap_psk_read() warn: unsigned 'keylen' is never less than zero.

vim +/keylen +430 drivers/nvme/common/keyring.c

   395	
   396	/**
   397	 * nvme_dhchap_psk_read - read callback for dhchap key types
   398	 * @key: key to read from
   399	 * @buffer: buffer for the key contents
   400	 * @buflen: length of @buffer
   401	 *
   402	 * Formets the DH-HMAC-CHAP key in base64-encoded form as
   403	 * defined in the NVM Express TCP Transport Specification Rev 1.1,
   404	 * Section 3.6.1.5 'PSK Interchange Format'. The payload of @key
   405	 * is assumed to be of 'struct user_key_payload', with the data
   406	 * consisting of the key data of length 'upayload->datalen', followed
   407	 * by four bytes of CRC, one byte version, and one byte hmac fields.
   408	 */
   409	static long nvme_dhchap_psk_read(const struct key *key,
   410					 char *buffer, size_t buflen)
   411	{
   412		const struct user_key_payload *upayload;
   413		size_t datalen, keylen;
   414		u8 version, hmac;
   415		long ret;
   416	
   417		upayload = user_key_payload_locked(key);
   418		/*
   419		 * Expected output string length:
   420		 * strlen("DHHC-") +
   421		 * version (= 1) +
   422		 * ':' (= 1) +
   423		 * hmac (= 2) +
   424		 * ':' (= 1) +
   425		 * encoded base64 key length +
   426		 * CRC length (= 4) +
   427		 * ':' (= 1)
   428		 */
   429		keylen = nvme_dhchap_decoded_key_size(upayload->datalen) + 15;
 > 430		if (keylen < 0 || !buffer || buflen == 0)
   431			return keylen;
   432	
   433		if (buflen < keylen)
   434			return -EINVAL;
   435	
   436		memset(buffer, 0, buflen);
   437		version = upayload->data[upayload->datalen + 4];
   438		hmac = upayload->data[upayload->datalen + 5];
   439		ret = sprintf(buffer, "DHHC-%01hhu:%02hhu:", version, hmac);
   440		if (ret < 0)
   441			return -ENOKEY;
   442		/* Include the trailing CRC */
   443		datalen = upayload->datalen + 4;
   444		ret += base64_encode(upayload->data, datalen, buffer + ret,
   445				     true, BASE64_STD);
   446		buffer[ret] = ':';
   447		ret++;
   448		return ret;
   449	}
   450	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki