From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
Date: Mon, 13 Jul 2026 11:05:51 +0800 [thread overview]
Message-ID: <202607131009.D6sc9jsR-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Marco Elver <elver@google.com>
CC: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
CC: "Harry Yoo (Oracle)" <harry@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 44696aa3a489d2baf58efa61b37833f100072bee
commit: feb662d9168b63e1d4c02671ec96005410c6f3ce slab: support for compiler-assisted type-based slab cache partitioning
date: 9 weeks ago
:::::: branch date: 27 hours ago
:::::: commit date: 9 weeks ago
config: i386-randconfig-r071-20260713 (https://download.01.org/0day-ci/archive/20260713/202607131009.D6sc9jsR-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607131009.D6sc9jsR-lkp@intel.com/
smatch warnings:
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
vim +285 drivers/platform/chrome/cros_ec_chardev.c
96a0a80738461d Enric Balletbo i Serra 2019-09-02 268
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 269 /*
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 270 * Ioctls
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 271 */
032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 272 static long cros_ec_chardev_ioctl_xcmd(struct chardev_priv *priv, void __user *arg)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 273 {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 274 struct cros_ec_command *s_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 275 struct cros_ec_command u_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 276 long ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 277
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 278 if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 279 return -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 280
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 281 if (u_cmd.outsize > EC_MAX_MSG_BYTES ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 282 u_cmd.insize > EC_MAX_MSG_BYTES)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 283 return -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 284
b20cf3f89c56b5 Tzung-Bi Shih 2023-03-24 @285 s_cmd = kzalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize),
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 286 GFP_KERNEL);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 287 if (!s_cmd)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 288 return -ENOMEM;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 289
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 290 if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + u_cmd.outsize)) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 291 ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 292 goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 293 }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 294
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 295 if (u_cmd.outsize != s_cmd->outsize ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 296 u_cmd.insize != s_cmd->insize) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 297 ret = -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 298 goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 299 }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 300
032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 301 s_cmd->command += priv->cmd_offset;
032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 302 ret = cros_ec_cmd_xfer(priv->ec_dev, s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 303 /* Only copy data to userland if data was received. */
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 304 if (ret < 0)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 305 goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 306
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 307 if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 308 ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 309 exit:
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 310 kfree(s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 311 return ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 312 }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 313
:::::: The code at line 285 was first introduced by commit
:::::: b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
:::::: TO: Tzung-Bi Shih <tzungbi@kernel.org>
:::::: CC: Tzung-Bi Shih <tzungbi@kernel.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-07-13 3:06 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607131009.D6sc9jsR-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.