Re: [PATCH v14 05/11] media: uvcvideo: Add support for compound controls

Dan Carpenter
2023-12-06T05:45:13Z

Hi Yunke,

kernel test robot noticed the following build warnings:

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Yunke-Cao/media-v4l2_ctrl-Add-V4L2_CTRL_TYPE_RECT/20231201-152501
base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/r/20231201071907.3080126-6-yunkec%40google.com
patch subject: [PATCH v14 05/11] media: uvcvideo: Add support for compound controls
config: powerpc64-randconfig-r081-20231204 (https://download.01.org/0day-ci/archive/20231206/202312060523.tldbovNM-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 13.2.0
reproduce: (https://download.01.org/0day-ci/archive/20231206/202312060523.tldbovNM-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202312060523.tldbovNM-lkp@intel.com/

smatch warnings:
drivers/media/usb/uvc/uvc_ctrl.c:2065 __uvc_ctrl_set_compound() warn: maybe return -EFAULT instead of the bytes remaining?

vim +2065 drivers/media/usb/uvc/uvc_ctrl.c

1a1a2af88920e9 Yunke Cao 2023-12-01 2040 static int __uvc_ctrl_set_compound(struct uvc_control_mapping *mapping,
1a1a2af88920e9 Yunke Cao 2023-12-01 2041 struct v4l2_ext_control *xctrl,
1a1a2af88920e9 Yunke Cao 2023-12-01 2042 struct uvc_control *ctrl)
1a1a2af88920e9 Yunke Cao 2023-12-01 2043 {
1a1a2af88920e9 Yunke Cao 2023-12-01 2044 u8 *data;
1a1a2af88920e9 Yunke Cao 2023-12-01 2045 int ret;
1a1a2af88920e9 Yunke Cao 2023-12-01 2046
1a1a2af88920e9 Yunke Cao 2023-12-01 2047 if (xctrl->size != mapping->v4l2_size / 8)
1a1a2af88920e9 Yunke Cao 2023-12-01 2048 return -EINVAL;
1a1a2af88920e9 Yunke Cao 2023-12-01 2049
1a1a2af88920e9 Yunke Cao 2023-12-01 2050 data = kmalloc(xctrl->size, GFP_KERNEL);
1a1a2af88920e9 Yunke Cao 2023-12-01 2051 if (!data)
1a1a2af88920e9 Yunke Cao 2023-12-01 2052 return -ENOMEM;
1a1a2af88920e9 Yunke Cao 2023-12-01 2053
1a1a2af88920e9 Yunke Cao 2023-12-01 2054 ret = copy_from_user(data, xctrl->ptr, xctrl->size);

copy_from_user() never returns negatives, it returns the number of bytes
remaining to be copied. This should be:

if (copy_from_user(data, xctrl->ptr, xctrl->size)) {
ret = -EFAULT;
goto out;
}

1a1a2af88920e9 Yunke Cao 2023-12-01 2055 if (ret < 0)
1a1a2af88920e9 Yunke Cao 2023-12-01 2056 goto out;
1a1a2af88920e9 Yunke Cao 2023-12-01 2057
1a1a2af88920e9 Yunke Cao 2023-12-01 2058 ret = mapping->set_compound(mapping, data,
1a1a2af88920e9 Yunke Cao 2023-12-01 2059 uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));
1a1a2af88920e9 Yunke Cao 2023-12-01 2060
1a1a2af88920e9 Yunke Cao 2023-12-01 2061 __uvc_ctrl_get_compound(mapping, ctrl, UVC_CTRL_DATA_CURRENT, xctrl);
1a1a2af88920e9 Yunke Cao 2023-12-01 2062
1a1a2af88920e9 Yunke Cao 2023-12-01 2063 out:
1a1a2af88920e9 Yunke Cao 2023-12-01 2064 kfree(data);
1a1a2af88920e9 Yunke Cao 2023-12-01 @2065 return ret;
1a1a2af88920e9 Yunke Cao 2023-12-01 2066 }

--
0-DAY CI Kernel Test Service