public inbox for linux-staging@lists.linux.dev
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@linaro.org>
To: Dave Penkler <dpenkler@gmail.com>
Cc: linux-staging@lists.linux.dev
Subject: [bug report] staging: gpib: Add GPIB common core driver
Date: Fri, 18 Oct 2024 09:32:22 +0300	[thread overview]
Message-ID: <4efd91f3-4259-4e95-a4e0-925853b98858@stanley.mountain> (raw)

Hello Dave Penkler,

Commit 9dde4559e939 ("staging: gpib: Add GPIB common core driver")
from Sep 18, 2024 (linux-next), leads to the following Smatch static
checker warning:

	drivers/staging/gpib/common/gpib_os.c:541 dvrsp()
	warn: no lower bound on 'sad' rl='s32min-30'

drivers/staging/gpib/common/gpib_os.c
    525 int dvrsp(gpib_board_t *board, unsigned int pad, int sad,
    526           unsigned int usec_timeout, uint8_t *result)
    527 {
    528         int status = ibstatus(board);
    529         int retval;
    530 
    531         if ((status & CIC) == 0) {
    532                 pr_err("gpib: not CIC during serial poll\n");
    533                 return -1;
    534         }
    535 
    536         if (pad > gpib_addr_max || sad > gpib_addr_max) {

sad comes from the user in serial_poll_ioctl() and it can be any int.

    537                 pr_err("gpib: bad address for serial poll");
    538                 return -1;
    539         }
    540 
--> 541         retval = serial_poll_single(board, pad, sad, usec_timeout, result);

Passing a negative doesn't do anything harmful and it looks like probably it's
intentional to mean there is no "sad".  But instead of saying that "any negative
is valid" it would be better to say that "-1" means there is no sad.

	if (pad > gpib_addr_max ||
	    (sad < -1 || sad > gpib_addr_max)) {
		...

Presumably the user space code is already passing -1 as the no sad value but I
don't maybe it's passing INT_MIN or something weird.  This is an API change.
We're allowed to change the API so long as we don't break userspace.  In
staging, we have a bit more leeway to break userspace as well honestly.

    542         if (io_timed_out(board))
    543                 retval = -ETIMEDOUT;
    544 
    545         return retval;
    546 }

regards,
dan carpenter

             reply	other threads:[~2024-10-18  6:32 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-10-18  6:32 Dan Carpenter [this message]
2024-12-07 12:05 ` [bug report] staging: gpib: Add GPIB common core driver Dave Penkler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4efd91f3-4259-4e95-a4e0-925853b98858@stanley.mountain \
    --to=dan.carpenter@linaro.org \
    --cc=dpenkler@gmail.com \
    --cc=linux-staging@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox