[pci:ptm-debugfs 1/4] drivers/pci/pcie/ptm.c:275 context_update_write() error: buffer overflow 'buf' 7 <= 7

[pci:ptm-debugfs 1/4] drivers/pci/pcie/ptm.c:275 context_update_write() error: buffer overflow 'buf' 7 <= 7

[Dan Carpenter]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git ptm-debugfs
head:   356fc3e997f3bf54448a8cb39b49c7d73959d166
commit: 1130deffd29ab25da8091b573e173ef9d889e827 [1/4] PCI: Add debugfs support for exposing PTM context
config: alpha-randconfig-r073-20250511 (https://download.01.org/0day-ci/archive/20250511/202505111829.bSouegRR-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 10.5.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202505111829.bSouegRR-lkp@intel.com/

smatch warnings:
drivers/pci/pcie/ptm.c:275 context_update_write() error: buffer overflow 'buf' 7 <= 7

vim +/buf +275 drivers/pci/pcie/ptm.c

1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  257  static ssize_t context_update_write(struct file *file, const char __user *ubuf,
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  258  			     size_t count, loff_t *ppos)
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  259  {
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  260  	struct pci_ptm_debugfs *ptm_debugfs = file->private_data;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  261  	char buf[7];
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  262  	int ret;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  263  	u8 mode;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  264  
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  265  	if (!ptm_debugfs->ops->context_update_write)
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  266  		return -EOPNOTSUPP;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  267  
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  268  	if (count < 1 || count > sizeof(buf))

Should be >= instead of >.

1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  269  		return -EINVAL;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  270  
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  271  	ret = copy_from_user(buf, ubuf, count);
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  272  	if (ret)
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  273  		return -EFAULT;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  274  
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05 @275  	buf[count] = '\0';
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  276  
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  277  	if (sysfs_streq(buf, "auto"))
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  278  		mode = PCIE_PTM_CONTEXT_UPDATE_AUTO;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  279  	else if (sysfs_streq(buf, "manual"))
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  280  		mode = PCIE_PTM_CONTEXT_UPDATE_MANUAL;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  281  	else
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  282  		return -EINVAL;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  283  
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  284  	mutex_lock(&ptm_debugfs->lock);
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  285  	ret = ptm_debugfs->ops->context_update_write(ptm_debugfs->pdata, mode);
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  286  	mutex_unlock(&ptm_debugfs->lock);
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  287  	if (ret)
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  288  		return ret;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  289  
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  290  	return count;
1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  291  }

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [pci:ptm-debugfs 1/4] drivers/pci/pcie/ptm.c:275 context_update_write() error: buffer overflow 'buf' 7 <= 7

[Krzysztof Wilczyński]

Hello,

[...]
> smatch warnings:
> drivers/pci/pcie/ptm.c:275 context_update_write() error: buffer overflow 'buf' 7 <= 7
> 
> vim +/buf +275 drivers/pci/pcie/ptm.c
> 
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  257  static ssize_t context_update_write(struct file *file, const char __user *ubuf,
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  258  			     size_t count, loff_t *ppos)
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  259  {
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  260  	struct pci_ptm_debugfs *ptm_debugfs = file->private_data;
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  261  	char buf[7];
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  262  	int ret;
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  263  	u8 mode;
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  264  
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  265  	if (!ptm_debugfs->ops->context_update_write)
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  266  		return -EOPNOTSUPP;
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  267  
> 1130deffd29ab2 Manivannan Sadhasivam 2025-05-05  268  	if (count < 1 || count > sizeof(buf))
> 
> Should be >= instead of >.

Done.  Fixed directly on the branch, see:

  https://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git/commit/?h=ptm-debugfs&id=132833405e61463d47d6badff1b8080b09b5808e

Thank you, Dan!

	Krzysztof