[bug report] bad error path in fsl_open_inb_mbox()

[bug report] bad error path in fsl_open_inb_mbox()

[Dan Carpenter]

Hello PPC devs,

Smatch has the following warning:

	arch/powerpc/sysdev/fsl_rmu.c:884 fsl_open_inb_mbox()
	error: buffer overflow 'rmu->msg_tx_ring.virt_buffer' 2048 <= 2048

arch/powerpc/sysdev/fsl_rmu.c
   861          for (i = 0; i < rmu->msg_rx_ring.size; i++)
   862                  rmu->msg_rx_ring.virt_buffer[i] = NULL;

Here we set i one past the end of the ->virt_buffer[] array.

   863  
   864          /* Initialize inbound message ring */
   865          rmu->msg_rx_ring.virt = dma_alloc_coherent(priv->dev,
   866                                  rmu->msg_rx_ring.size * RIO_MAX_MSG_SIZE,
   867                                  &rmu->msg_rx_ring.phys, GFP_KERNEL);
   868          if (!rmu->msg_rx_ring.virt) {
   869                  rc = -ENOMEM;
   870                  goto out;
   871          }
   872  
   873          /* Point dequeue/enqueue pointers at first entry in ring */
   874          out_be32(&rmu->msg_regs->ifqdpar, (u32) rmu->msg_rx_ring.phys);
   875          out_be32(&rmu->msg_regs->ifqepar, (u32) rmu->msg_rx_ring.phys);
   876  
   877          /* Clear interrupt status */
   878          out_be32(&rmu->msg_regs->isr, 0x00000091);
   879  
   880          /* Hook up inbound message handler */
   881          rc = request_irq(IRQ_RIO_RX(mport), fsl_rio_rx_handler, 0,
   882                           "msg_rx", (void *)mport);
   883          if (rc < 0) {
   884                  dma_free_coherent(priv->dev, RIO_MSG_BUFFER_SIZE,
   885                          rmu->msg_tx_ring.virt_buffer[i],
                                                 ^^^^^^^^^^^^^^
Wrong variable.

   886                          rmu->msg_tx_ring.phys_buffer[i]);
                                                 ^^^^^^^^^^^^^^

This should probably be something like:

			dma_free_coherent(priv->dev,
				rmu->msg_rx_ring.size * RIO_MAX_MSG_SIZE,
				rmu->msg_rx_ring.virt, rmu->msg_rx_ring.phys);

But dma_free_coherent() is poorly documented (it's not documented at
all) and I can't even compile this code so I don't feel comfortable
patching this myself.

Please give me a Reported-by tag if you fix this.

   887                  goto out;
   888          }

regards,
dan carpenter