Re: [PATCH v2 1/2] media: az6007: fix out-of-bounds in az6007_i2c_xfer()

kernel test robot
2025-09-09T05:57:27Z

Hi Jeongjun,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linuxtv-media-pending/master]
[also build test WARNING on linus/master v6.17-rc5 next-20250908]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Jeongjun-Park/media-az6007-fix-out-of-bounds-in-az6007_i2c_xfer/20250908-231026
base: https://git.linuxtv.org/media-ci/media-pending.git master
patch link: https://lore.kernel.org/r/20250908150730.24560-2-aha310510%40gmail.com
patch subject: [PATCH v2 1/2] media: az6007: fix out-of-bounds in az6007_i2c_xfer()
config: hexagon-allyesconfig (https://download.01.org/0day-ci/archive/20250909/202509091306.eGl2abHr-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 7fb1dc08d2f025aad5777bb779dfac1197e9ef87)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250909/202509091306.eGl2abHr-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509091306.eGl2abHr-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/media/usb/dvb-usb-v2/az6007.c:107:16: warning: format specifies type 'unsigned long' but the argument has type '__size_t' (aka 'unsigned int') [-Wformat]
106 | pr_err("az6007: tried to read %d bytes, but I2C max size is %lu bytes\n",
| ~~~
| %zu
107 | blen, sizeof(st->data));
| ^~~~~~~~~~~~~~~~
include/linux/printk.h:557:33: note: expanded from macro 'pr_err'
557 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:514:60: note: expanded from macro 'printk'
514 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:486:19: note: expanded from macro 'printk_index_wrap'
486 | _p_func(_fmt, ##__VA_ARGS__); \
| ~~~~ ^~~~~~~~~~~
drivers/media/usb/dvb-usb-v2/az6007.c:154:16: warning: format specifies type 'unsigned long' but the argument has type '__size_t' (aka 'unsigned int') [-Wformat]
153 | pr_err("az6007: tried to write %d bytes, but I2C max size is %lu bytes\n",
| ~~~
| %zu
154 | blen, sizeof(st->data));
| ^~~~~~~~~~~~~~~~
include/linux/printk.h:557:33: note: expanded from macro 'pr_err'
557 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:514:60: note: expanded from macro 'printk'
514 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:486:19: note: expanded from macro 'printk_index_wrap'
486 | _p_func(_fmt, ##__VA_ARGS__); \
| ~~~~ ^~~~~~~~~~~
2 warnings generated.

vim +107 drivers/media/usb/dvb-usb-v2/az6007.c

99
100 static int __az6007_read(struct usb_device *udev, struct az6007_device_state *st,
101 u8 req, u16 value, u16 index, u8 *b, int blen)
102 {
103 int ret;
104
105 if (blen > sizeof(st->data)) {
106 pr_err("az6007: tried to read %d bytes, but I2C max size is %lu bytes\n",
> 107 blen, sizeof(st->data));
108 return -EOPNOTSUPP;
109 }
110
111 ret = usb_control_msg(udev,
112 usb_rcvctrlpipe(udev, 0),
113 req,
114 USB_TYPE_VENDOR | USB_DIR_IN,
115 value, index, b, blen, 5000);
116 if (ret < 0) {
117 pr_warn("usb read operation failed. (%d)\n", ret);
118 return -EIO;
119 }
120
121 if (az6007_xfer_debug) {
122 printk(KERN_DEBUG "az6007: IN req: %02x, value: %04x, index: %04x\n",
123 req, value, index);
124 print_hex_dump_bytes("az6007: payload: ",
125 DUMP_PREFIX_NONE, b, blen);
126 }
127
128 return ret;
129 }
130

--
0-DAY CI Kernel Test Service