All of lore.kernel.org
 help / color / mirror / Atom feed
From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
Date: Mon, 13 Jul 2026 11:05:51 +0800	[thread overview]
Message-ID: <202607131009.D6sc9jsR-lkp@intel.com> (raw)

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Marco Elver <elver@google.com>
CC: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
CC: "Harry Yoo (Oracle)" <harry@kernel.org>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   44696aa3a489d2baf58efa61b37833f100072bee
commit: feb662d9168b63e1d4c02671ec96005410c6f3ce slab: support for compiler-assisted type-based slab cache partitioning
date:   9 weeks ago
:::::: branch date: 27 hours ago
:::::: commit date: 9 weeks ago
config: i386-randconfig-r071-20260713 (https://download.01.org/0day-ci/archive/20260713/202607131009.D6sc9jsR-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607131009.D6sc9jsR-lkp@intel.com/

smatch warnings:
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'

vim +285 drivers/platform/chrome/cros_ec_chardev.c

96a0a80738461d Enric Balletbo i Serra 2019-09-02  268  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  269  /*
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  270   * Ioctls
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  271   */
032c59c1d3cd45 Tzung-Bi Shih          2025-07-21  272  static long cros_ec_chardev_ioctl_xcmd(struct chardev_priv *priv, void __user *arg)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  273  {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  274  	struct cros_ec_command *s_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  275  	struct cros_ec_command u_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  276  	long ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  277  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  278  	if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  279  		return -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  280  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  281  	if (u_cmd.outsize > EC_MAX_MSG_BYTES ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  282  	    u_cmd.insize > EC_MAX_MSG_BYTES)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  283  		return -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  284  
b20cf3f89c56b5 Tzung-Bi Shih          2023-03-24 @285  	s_cmd = kzalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize),
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  286  			GFP_KERNEL);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  287  	if (!s_cmd)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  288  		return -ENOMEM;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  289  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  290  	if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + u_cmd.outsize)) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  291  		ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  292  		goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  293  	}
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  294  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  295  	if (u_cmd.outsize != s_cmd->outsize ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  296  	    u_cmd.insize != s_cmd->insize) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  297  		ret = -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  298  		goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  299  	}
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  300  
032c59c1d3cd45 Tzung-Bi Shih          2025-07-21  301  	s_cmd->command += priv->cmd_offset;
032c59c1d3cd45 Tzung-Bi Shih          2025-07-21  302  	ret = cros_ec_cmd_xfer(priv->ec_dev, s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  303  	/* Only copy data to userland if data was received. */
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  304  	if (ret < 0)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  305  		goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  306  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  307  	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  308  		ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  309  exit:
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  310  	kfree(s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  311  	return ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  312  }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  313  

:::::: The code at line 285 was first introduced by commit
:::::: b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

:::::: TO: Tzung-Bi Shih <tzungbi@kernel.org>
:::::: CC: Tzung-Bi Shih <tzungbi@kernel.org>

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

                 reply	other threads:[~2026-07-13  3:06 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202607131009.D6sc9jsR-lkp@intel.com \
    --to=lkp@intel.com \
    --cc=error27@gmail.com \
    --cc=oe-kbuild@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.