[PATCH] Input: ads7846 - Increase xfer array size in 'struct ser_req'

[PATCH] Input: ads7846 - Increase xfer array size in 'struct ser_req'

[Nathan Chancellor]

Clang warns (or errors with CONFIG_WERROR=y, trimmed for brevity):

  drivers/input/touchscreen/ads7846.c:412:2: error: array index 6 is past the end of the array (that has type 'struct spi_transfer[6]') [-Werror,-Warray-bounds]
    412 |         req->xfer[6].tx_buf = &req->scratch;
        |         ^         ~
  ...
  drivers/input/touchscreen/ads7846.c:416:2: error: array index 7 is past the end of the array (that has type 'struct spi_transfer[6]') [-Werror,-Warray-bounds]
    416 |         req->xfer[7].rx_buf = &req->scratch;
        |         ^         ~
  drivers/input/touchscreen/ads7846.c:334:2: note: array 'xfer' declared here
    334 |         struct spi_transfer     xfer[6];
        |         ^

Increase the size of xfer in 'struct ser_req' to ensure that there is
enough space for all necessary members and there are no out of bounds
accesses, clearing up the warning.

Fixes: 781a07da9bb9 ("Input: ads7846 - add dummy command register clearing cycle")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index f7bc0a3e56d86932823b6bc0dcd6bcd8e1b9b5c2..7b3711a3597c86f18c45d040f73bef884ec3c4aa 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -331,7 +331,7 @@ struct ser_req {
 	u8			ref_off;
 	u16			scratch;
 	struct spi_message	msg;
-	struct spi_transfer	xfer[6];
+	struct spi_transfer	xfer[8];
 	/*
 	 * DMA (thus cache coherency maintenance) requires the
 	 * transfer buffers to live in their own cache lines.

---
base-commit: bed0f75909b21c0cd0285da76fdfcc61a9745b0c
change-id: 20241111-input-ads7846-increase-xfer-array-size-2603a15ad062

Best regards,
-- 
Nathan Chancellor <nathan@kernel.org>

Re: [PATCH] Input: ads7846 - Increase xfer array size in 'struct ser_req'

[Marek Vasut]

On 11/11/24 4:09 PM, Nathan Chancellor wrote:
> Clang warns (or errors with CONFIG_WERROR=y, trimmed for brevity):
> 
>    drivers/input/touchscreen/ads7846.c:412:2: error: array index 6 is past the end of the array (that has type 'struct spi_transfer[6]') [-Werror,-Warray-bounds]
>      412 |         req->xfer[6].tx_buf = &req->scratch;
>          |         ^         ~
>    ...
>    drivers/input/touchscreen/ads7846.c:416:2: error: array index 7 is past the end of the array (that has type 'struct spi_transfer[6]') [-Werror,-Warray-bounds]
>      416 |         req->xfer[7].rx_buf = &req->scratch;
>          |         ^         ~
>    drivers/input/touchscreen/ads7846.c:334:2: note: array 'xfer' declared here
>      334 |         struct spi_transfer     xfer[6];
>          |         ^
> 
> Increase the size of xfer in 'struct ser_req' to ensure that there is
> enough space for all necessary members and there are no out of bounds
> accesses, clearing up the warning.
> 
> Fixes: 781a07da9bb9 ("Input: ads7846 - add dummy command register clearing cycle")
> Signed-off-by: Nathan Chancellor <nathan@kernel.org>
> ---
>   drivers/input/touchscreen/ads7846.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
> index f7bc0a3e56d86932823b6bc0dcd6bcd8e1b9b5c2..7b3711a3597c86f18c45d040f73bef884ec3c4aa 100644
> --- a/drivers/input/touchscreen/ads7846.c
> +++ b/drivers/input/touchscreen/ads7846.c
> @@ -331,7 +331,7 @@ struct ser_req {
>   	u8			ref_off;
>   	u16			scratch;
>   	struct spi_message	msg;
> -	struct spi_transfer	xfer[6];
> +	struct spi_transfer	xfer[8];
Sigh ...

Reviewed-by: Marek Vasut <marex@denx.de>

Thank you

Re: [PATCH] Input: ads7846 - Increase xfer array size in 'struct ser_req'

[Dmitry Torokhov]

On Mon, Nov 11, 2024 at 08:09:55AM -0700, Nathan Chancellor wrote:
> Clang warns (or errors with CONFIG_WERROR=y, trimmed for brevity):
> 
>   drivers/input/touchscreen/ads7846.c:412:2: error: array index 6 is past the end of the array (that has type 'struct spi_transfer[6]') [-Werror,-Warray-bounds]
>     412 |         req->xfer[6].tx_buf = &req->scratch;
>         |         ^         ~
>   ...
>   drivers/input/touchscreen/ads7846.c:416:2: error: array index 7 is past the end of the array (that has type 'struct spi_transfer[6]') [-Werror,-Warray-bounds]
>     416 |         req->xfer[7].rx_buf = &req->scratch;
>         |         ^         ~
>   drivers/input/touchscreen/ads7846.c:334:2: note: array 'xfer' declared here
>     334 |         struct spi_transfer     xfer[6];
>         |         ^
> 
> Increase the size of xfer in 'struct ser_req' to ensure that there is
> enough space for all necessary members and there are no out of bounds
> accesses, clearing up the warning.
> 
> Fixes: 781a07da9bb9 ("Input: ads7846 - add dummy command register clearing cycle")
> Signed-off-by: Nathan Chancellor <nathan@kernel.org>

Applied, thank you.

-- 
Dmitry