From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [android-common:android16-6.12-p3s 2/2] drivers/md/dm-verity-fec.c:136 fec_decode_bufs() error: buffer overflow 'par_buf' 24 <= u32max
Date: Sat, 31 Oct 2026 20:32:18 +0100 [thread overview]
Message-ID: <202610312038.Un7RLzdP-lkp@intel.com> (raw)
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: cros-kernel-buildreports@googlegroups.com
tree: https://android.googlesource.com/kernel/common android16-6.12-p3s
head: cf32e70ca1c409f3b7da2e8d3640dbbb3104be5d
commit: 5e49cda1a1763a2fcf85bff26b21b3ed85b38fd5 [2/2] UPSTREAM: dm-verity FEC: Avoid copying RS parity bytes twice.
:::::: branch date: 21 hours ago
:::::: commit date: 7 weeks ago
config: i386-randconfig-r2200-20261030 (https://download.01.org/0day-ci/archive/20261031/202610312038.Un7RLzdP-lkp@intel.com/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202610312038.Un7RLzdP-lkp@intel.com/
smatch warnings:
drivers/md/dm-verity-fec.c:136 fec_decode_bufs() error: buffer overflow 'par_buf' 24 <= u32max
vim +/par_buf +136 drivers/md/dm-verity-fec.c
a739ff3f543afbb Sami Tolvanen 2015-12-03 108
a739ff3f543afbb Sami Tolvanen 2015-12-03 109 /*
a739ff3f543afbb Sami Tolvanen 2015-12-03 110 * Decode all RS blocks from buffers and copy corrected bytes into fio->output
a739ff3f543afbb Sami Tolvanen 2015-12-03 111 * starting from block_offset.
a739ff3f543afbb Sami Tolvanen 2015-12-03 112 */
d95e2c34a3ca768 Hongyu Jin 2024-01-24 113 static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_io *io,
d95e2c34a3ca768 Hongyu Jin 2024-01-24 114 struct dm_verity_fec_io *fio, u64 rsb, int byte_index,
d95e2c34a3ca768 Hongyu Jin 2024-01-24 115 unsigned int block_offset, int neras)
a739ff3f543afbb Sami Tolvanen 2015-12-03 116 {
a739ff3f543afbb Sami Tolvanen 2015-12-03 117 int r, corrected = 0, res;
a739ff3f543afbb Sami Tolvanen 2015-12-03 118 struct dm_buffer *buf;
5e49cda1a1763a2 Milan Broz 2024-12-18 119 unsigned int n, i, j, offset, par_buf_offset = 0;
5e49cda1a1763a2 Milan Broz 2024-12-18 120 uint16_t par_buf[DM_VERITY_FEC_RSM - DM_VERITY_FEC_MIN_RSN];
5e49cda1a1763a2 Milan Broz 2024-12-18 121 u8 *par, *block;
d95e2c34a3ca768 Hongyu Jin 2024-01-24 122 struct bio *bio = dm_bio_from_per_bio_data(io, v->ti->per_io_data_size);
a739ff3f543afbb Sami Tolvanen 2015-12-03 123
fc8943886629e26 Milan Broz 2024-12-18 124 par = fec_read_parity(v, rsb, block_offset, &offset,
fc8943886629e26 Milan Broz 2024-12-18 125 par_buf_offset, &buf, bio_prio(bio));
a739ff3f543afbb Sami Tolvanen 2015-12-03 126 if (IS_ERR(par))
a739ff3f543afbb Sami Tolvanen 2015-12-03 127 return PTR_ERR(par);
a739ff3f543afbb Sami Tolvanen 2015-12-03 128
a739ff3f543afbb Sami Tolvanen 2015-12-03 129 /*
a739ff3f543afbb Sami Tolvanen 2015-12-03 130 * Decode the RS blocks we have in bufs. Each RS block results in
a739ff3f543afbb Sami Tolvanen 2015-12-03 131 * one corrected target byte and consumes fec->roots parity bytes.
a739ff3f543afbb Sami Tolvanen 2015-12-03 132 */
a739ff3f543afbb Sami Tolvanen 2015-12-03 133 fec_for_each_buffer_rs_block(fio, n, i) {
a739ff3f543afbb Sami Tolvanen 2015-12-03 134 block = fec_buffer_rs_block(v, fio, n, i);
5e49cda1a1763a2 Milan Broz 2024-12-18 135 for (j = 0; j < v->fec->roots - par_buf_offset; j++)
5e49cda1a1763a2 Milan Broz 2024-12-18 @136 par_buf[par_buf_offset + j] = par[offset + j];
5e49cda1a1763a2 Milan Broz 2024-12-18 137 /* Decode an RS block using Reed-Solomon */
5e49cda1a1763a2 Milan Broz 2024-12-18 138 res = decode_rs8(fio->rs, block, par_buf, v->fec->rsn,
5e49cda1a1763a2 Milan Broz 2024-12-18 139 NULL, neras, fio->erasures, 0, NULL);
a739ff3f543afbb Sami Tolvanen 2015-12-03 140 if (res < 0) {
a739ff3f543afbb Sami Tolvanen 2015-12-03 141 r = res;
a739ff3f543afbb Sami Tolvanen 2015-12-03 142 goto error;
a739ff3f543afbb Sami Tolvanen 2015-12-03 143 }
a739ff3f543afbb Sami Tolvanen 2015-12-03 144
a739ff3f543afbb Sami Tolvanen 2015-12-03 145 corrected += res;
a739ff3f543afbb Sami Tolvanen 2015-12-03 146 fio->output[block_offset] = block[byte_index];
a739ff3f543afbb Sami Tolvanen 2015-12-03 147
a739ff3f543afbb Sami Tolvanen 2015-12-03 148 block_offset++;
a739ff3f543afbb Sami Tolvanen 2015-12-03 149 if (block_offset >= 1 << v->data_dev_block_bits)
a739ff3f543afbb Sami Tolvanen 2015-12-03 150 goto done;
a739ff3f543afbb Sami Tolvanen 2015-12-03 151
fc8943886629e26 Milan Broz 2024-12-18 152 /* Read the next block when we run out of parity bytes */
fc8943886629e26 Milan Broz 2024-12-18 153 offset += (v->fec->roots - par_buf_offset);
fc8943886629e26 Milan Broz 2024-12-18 154 /* Check if parity bytes are split between blocks */
fc8943886629e26 Milan Broz 2024-12-18 155 if (offset < v->fec->io_size && (offset + v->fec->roots) > v->fec->io_size) {
fc8943886629e26 Milan Broz 2024-12-18 156 par_buf_offset = v->fec->io_size - offset;
5e49cda1a1763a2 Milan Broz 2024-12-18 157 for (j = 0; j < par_buf_offset; j++)
5e49cda1a1763a2 Milan Broz 2024-12-18 158 par_buf[j] = par[offset + j];
fc8943886629e26 Milan Broz 2024-12-18 159 offset += par_buf_offset;
fc8943886629e26 Milan Broz 2024-12-18 160 } else
fc8943886629e26 Milan Broz 2024-12-18 161 par_buf_offset = 0;
fc8943886629e26 Milan Broz 2024-12-18 162
8ca7cab82bda4eb Jaegeuk Kim 2021-04-14 163 if (offset >= v->fec->io_size) {
a739ff3f543afbb Sami Tolvanen 2015-12-03 164 dm_bufio_release(buf);
a739ff3f543afbb Sami Tolvanen 2015-12-03 165
fc8943886629e26 Milan Broz 2024-12-18 166 par = fec_read_parity(v, rsb, block_offset, &offset,
fc8943886629e26 Milan Broz 2024-12-18 167 par_buf_offset, &buf, bio_prio(bio));
821b40da4d91839 Chengguang Xu 2019-02-13 168 if (IS_ERR(par))
a739ff3f543afbb Sami Tolvanen 2015-12-03 169 return PTR_ERR(par);
a739ff3f543afbb Sami Tolvanen 2015-12-03 170 }
a739ff3f543afbb Sami Tolvanen 2015-12-03 171 }
a739ff3f543afbb Sami Tolvanen 2015-12-03 172 done:
a739ff3f543afbb Sami Tolvanen 2015-12-03 173 r = corrected;
a739ff3f543afbb Sami Tolvanen 2015-12-03 174 error:
86e3e83b443669d Sami Tolvanen 2017-03-31 175 dm_bufio_release(buf);
86e3e83b443669d Sami Tolvanen 2017-03-31 176
a739ff3f543afbb Sami Tolvanen 2015-12-03 177 if (r < 0 && neras)
a739ff3f543afbb Sami Tolvanen 2015-12-03 178 DMERR_LIMIT("%s: FEC %llu: failed to correct: %d",
a739ff3f543afbb Sami Tolvanen 2015-12-03 179 v->data_dev->name, (unsigned long long)rsb, r);
a739ff3f543afbb Sami Tolvanen 2015-12-03 180 else if (r > 0)
a739ff3f543afbb Sami Tolvanen 2015-12-03 181 DMWARN_LIMIT("%s: FEC %llu: corrected %d errors",
a739ff3f543afbb Sami Tolvanen 2015-12-03 182 v->data_dev->name, (unsigned long long)rsb, r);
a739ff3f543afbb Sami Tolvanen 2015-12-03 183
a739ff3f543afbb Sami Tolvanen 2015-12-03 184 return r;
a739ff3f543afbb Sami Tolvanen 2015-12-03 185 }
a739ff3f543afbb Sami Tolvanen 2015-12-03 186
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-10-31 19:32 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202610312038.Un7RLzdP-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.