drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'

drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'

[kernel test robot]

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Marco Elver <elver@google.com>
CC: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
CC: "Harry Yoo (Oracle)" <harry@kernel.org>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   44696aa3a489d2baf58efa61b37833f100072bee
commit: feb662d9168b63e1d4c02671ec96005410c6f3ce slab: support for compiler-assisted type-based slab cache partitioning
date:   9 weeks ago
:::::: branch date: 27 hours ago
:::::: commit date: 9 weeks ago
config: i386-randconfig-r071-20260713 (https://download.01.org/0day-ci/archive/20260713/202607131009.D6sc9jsR-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607131009.D6sc9jsR-lkp@intel.com/

smatch warnings:
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'

vim +285 drivers/platform/chrome/cros_ec_chardev.c

96a0a80738461d Enric Balletbo i Serra 2019-09-02  268  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  269  /*
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  270   * Ioctls
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  271   */
032c59c1d3cd45 Tzung-Bi Shih          2025-07-21  272  static long cros_ec_chardev_ioctl_xcmd(struct chardev_priv *priv, void __user *arg)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  273  {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  274  	struct cros_ec_command *s_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  275  	struct cros_ec_command u_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  276  	long ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  277  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  278  	if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  279  		return -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  280  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  281  	if (u_cmd.outsize > EC_MAX_MSG_BYTES ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  282  	    u_cmd.insize > EC_MAX_MSG_BYTES)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  283  		return -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  284  
b20cf3f89c56b5 Tzung-Bi Shih          2023-03-24 @285  	s_cmd = kzalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize),
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  286  			GFP_KERNEL);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  287  	if (!s_cmd)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  288  		return -ENOMEM;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  289  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  290  	if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + u_cmd.outsize)) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  291  		ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  292  		goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  293  	}
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  294  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  295  	if (u_cmd.outsize != s_cmd->outsize ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  296  	    u_cmd.insize != s_cmd->insize) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  297  		ret = -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  298  		goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  299  	}
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  300  
032c59c1d3cd45 Tzung-Bi Shih          2025-07-21  301  	s_cmd->command += priv->cmd_offset;
032c59c1d3cd45 Tzung-Bi Shih          2025-07-21  302  	ret = cros_ec_cmd_xfer(priv->ec_dev, s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  303  	/* Only copy data to userland if data was received. */
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  304  	if (ret < 0)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  305  		goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  306  
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  307  	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  308  		ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  309  exit:
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  310  	kfree(s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  311  	return ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  312  }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02  313  

:::::: The code at line 285 was first introduced by commit
:::::: b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

:::::: TO: Tzung-Bi Shih <tzungbi@kernel.org>
:::::: CC: Tzung-Bi Shih <tzungbi@kernel.org>

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki