* [patch] iio: tsl2583: make array large enough [not found] <20161118140326.GA20458@basecamp.onstation.org> @ 2016-11-24 13:38 ` Dan Carpenter 2016-11-24 15:48 ` Brian Masney 0 siblings, 1 reply; 6+ messages in thread From: Dan Carpenter @ 2016-11-24 13:38 UTC (permalink / raw) To: Jonathan Cameron Cc: Hartmut Knaack, Lars-Peter Clausen, Peter Meerwald-Stadler, Brian Masney, Greg Kroah-Hartman, Eva Rachel Retuya, linux-iio, linux-kernel, kernel-janitors This array is supposed to have 10 elements. Smatch complains that with the current code we can have n == max_ints and read beyond the end of the array. Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c index 0b87f6a..a78b602 100644 --- a/drivers/iio/light/tsl2583.c +++ b/drivers/iio/light/tsl2583.c @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev, struct iio_dev *indio_dev = dev_to_iio_dev(dev); struct tsl2583_chip *chip = iio_priv(indio_dev); const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3; - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3]; + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1]; int ret = -EINVAL; unsigned int n; ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [patch] iio: tsl2583: make array large enough 2016-11-24 13:38 ` [patch] iio: tsl2583: make array large enough Dan Carpenter @ 2016-11-24 15:48 ` Brian Masney 2016-11-24 16:54 ` walter harms 0 siblings, 1 reply; 6+ messages in thread From: Brian Masney @ 2016-11-24 15:48 UTC (permalink / raw) To: Dan Carpenter Cc: Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen, Peter Meerwald-Stadler, Greg Kroah-Hartman, Eva Rachel Retuya, linux-iio, linux-kernel, kernel-janitors On Thu, Nov 24, 2016 at 04:38:07PM +0300, Dan Carpenter wrote: > This array is supposed to have 10 elements. Smatch complains that with > the current code we can have n == max_ints and read beyond the end of > the array. > > Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c > index 0b87f6a..a78b602 100644 > --- a/drivers/iio/light/tsl2583.c > +++ b/drivers/iio/light/tsl2583.c > @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev, > struct iio_dev *indio_dev = dev_to_iio_dev(dev); > struct tsl2583_chip *chip = iio_priv(indio_dev); > const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3; > - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3]; > + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1]; > int ret = -EINVAL; > unsigned int n; > Acked-by: Brian Masney <masneyb@onstation.org> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch] iio: tsl2583: make array large enough 2016-11-24 15:48 ` Brian Masney @ 2016-11-24 16:54 ` walter harms 2016-11-24 17:51 ` Brian Masney 0 siblings, 1 reply; 6+ messages in thread From: walter harms @ 2016-11-24 16:54 UTC (permalink / raw) To: Brian Masney Cc: Dan Carpenter, Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen, Peter Meerwald-Stadler, Greg Kroah-Hartman, Eva Rachel Retuya, linux-iio, linux-kernel, kernel-janitors Am 24.11.2016 16:48, schrieb Brian Masney: > On Thu, Nov 24, 2016 at 04:38:07PM +0300, Dan Carpenter wrote: >> This array is supposed to have 10 elements. Smatch complains that with >> the current code we can have n == max_ints and read beyond the end of >> the array. >> >> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >> >> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c >> index 0b87f6a..a78b602 100644 >> --- a/drivers/iio/light/tsl2583.c >> +++ b/drivers/iio/light/tsl2583.c >> @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev, >> struct iio_dev *indio_dev = dev_to_iio_dev(dev); >> struct tsl2583_chip *chip = iio_priv(indio_dev); >> const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3; >> - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3]; >> + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1]; >> int ret = -EINVAL; >> unsigned int n; >> > sorry i did not notice that bevor .. there is a max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3 IMHO this should read either: int value[max_ints+1]; or max_ints=ARRAY_SIZE(value)-1; (my personal favorite is dropping max_ints completely). re, wh ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch] iio: tsl2583: make array large enough 2016-11-24 16:54 ` walter harms @ 2016-11-24 17:51 ` Brian Masney 2016-11-24 20:12 ` Jonathan Cameron 2016-11-25 8:53 ` walter harms 0 siblings, 2 replies; 6+ messages in thread From: Brian Masney @ 2016-11-24 17:51 UTC (permalink / raw) To: walter harms Cc: Dan Carpenter, Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen, Peter Meerwald-Stadler, Greg Kroah-Hartman, Eva Rachel Retuya, linux-iio, linux-kernel, kernel-janitors On Thu, Nov 24, 2016 at 05:54:17PM +0100, walter harms wrote: > > > Am 24.11.2016 16:48, schrieb Brian Masney: > > On Thu, Nov 24, 2016 at 04:38:07PM +0300, Dan Carpenter wrote: > >> This array is supposed to have 10 elements. Smatch complains that with > >> the current code we can have n == max_ints and read beyond the end of > >> the array. > >> > >> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") > >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > >> > >> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c > >> index 0b87f6a..a78b602 100644 > >> --- a/drivers/iio/light/tsl2583.c > >> +++ b/drivers/iio/light/tsl2583.c > >> @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev, > >> struct iio_dev *indio_dev = dev_to_iio_dev(dev); > >> struct tsl2583_chip *chip = iio_priv(indio_dev); > >> const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3; > >> - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3]; > >> + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1]; > >> int ret = -EINVAL; > >> unsigned int n; > >> > > > > sorry i did not notice that bevor .. > there is a > max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3 > > IMHO this should read either: > int value[max_ints+1]; I originally went this route when I refactored the function, however running make C=1 yields the following warnings: drivers/iio/light/tsl2583.c:568:19: warning: Variable length array is used. drivers/iio/light/tsl2583.c:574:26: error: cannot size expression That is why I went with the current implementation. > or > max_ints=ARRAY_SIZE(value)-1; > > (my personal favorite is dropping max_ints completely). The max_ints value is also shown in the error message if the user passes in too many or too few entries in the per device lux table. I wanted the user to see the maximum allowable number without having to dig through the kernel source code. Without it, I would have had to duplicate the TSL2583_MAX_LUX_TABLE_ENTRIES * 3 statement a third time. Brian ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch] iio: tsl2583: make array large enough 2016-11-24 17:51 ` Brian Masney @ 2016-11-24 20:12 ` Jonathan Cameron 2016-11-25 8:53 ` walter harms 1 sibling, 0 replies; 6+ messages in thread From: Jonathan Cameron @ 2016-11-24 20:12 UTC (permalink / raw) To: Brian Masney, walter harms Cc: Dan Carpenter, Hartmut Knaack, Lars-Peter Clausen, Peter Meerwald-Stadler, Greg Kroah-Hartman, Eva Rachel Retuya, linux-iio, linux-kernel, kernel-janitors On 24/11/16 17:51, Brian Masney wrote: > On Thu, Nov 24, 2016 at 05:54:17PM +0100, walter harms wrote: >> >> >> Am 24.11.2016 16:48, schrieb Brian Masney: >>> On Thu, Nov 24, 2016 at 04:38:07PM +0300, Dan Carpenter wrote: >>>> This array is supposed to have 10 elements. Smatch complains that with >>>> the current code we can have n == max_ints and read beyond the end of >>>> the array. >>>> >>>> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") >>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >>>> >>>> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c >>>> index 0b87f6a..a78b602 100644 >>>> --- a/drivers/iio/light/tsl2583.c >>>> +++ b/drivers/iio/light/tsl2583.c >>>> @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev, >>>> struct iio_dev *indio_dev = dev_to_iio_dev(dev); >>>> struct tsl2583_chip *chip = iio_priv(indio_dev); >>>> const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3; >>>> - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3]; >>>> + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1]; >>>> int ret = -EINVAL; >>>> unsigned int n; >>>> >>> >> >> sorry i did not notice that bevor .. >> there is a >> max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3 >> >> IMHO this should read either: >> int value[max_ints+1]; > > I originally went this route when I refactored the function, however > running make C=1 yields the following warnings: > > drivers/iio/light/tsl2583.c:568:19: warning: Variable length array is > used. > drivers/iio/light/tsl2583.c:574:26: error: cannot size expression > > That is why I went with the current implementation. > >> or >> max_ints=ARRAY_SIZE(value)-1; >> >> (my personal favorite is dropping max_ints completely). > > The max_ints value is also shown in the error message if the user passes > in too many or too few entries in the per device lux table. I wanted the > user to see the maximum allowable number without having to dig through > the kernel source code. Without it, I would have had to duplicate the > TSL2583_MAX_LUX_TABLE_ENTRIES * 3 statement a third time. > > Brian > I'm taking this as is, because it'll just squeeze into my last pull request to Greg. Sorry for not waiting for this discussion to finish first! Applied to the togreg branch of iio.git and pushed out as testing for the autobuilders to very briefly play with it. Thanks, Jonathan ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch] iio: tsl2583: make array large enough 2016-11-24 17:51 ` Brian Masney 2016-11-24 20:12 ` Jonathan Cameron @ 2016-11-25 8:53 ` walter harms 1 sibling, 0 replies; 6+ messages in thread From: walter harms @ 2016-11-25 8:53 UTC (permalink / raw) To: Brian Masney Cc: Dan Carpenter, Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen, Peter Meerwald-Stadler, Greg Kroah-Hartman, Eva Rachel Retuya, linux-iio, linux-kernel, kernel-janitors Am 24.11.2016 18:51, schrieb Brian Masney: > On Thu, Nov 24, 2016 at 05:54:17PM +0100, walter harms wrote: >> >> >> Am 24.11.2016 16:48, schrieb Brian Masney: >>> On Thu, Nov 24, 2016 at 04:38:07PM +0300, Dan Carpenter wrote: >>>> This array is supposed to have 10 elements. Smatch complains that with >>>> the current code we can have n == max_ints and read beyond the end of >>>> the array. >>>> >>>> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") >>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >>>> >>>> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c >>>> index 0b87f6a..a78b602 100644 >>>> --- a/drivers/iio/light/tsl2583.c >>>> +++ b/drivers/iio/light/tsl2583.c >>>> @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev, >>>> struct iio_dev *indio_dev = dev_to_iio_dev(dev); >>>> struct tsl2583_chip *chip = iio_priv(indio_dev); >>>> const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3; >>>> - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3]; >>>> + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1]; >>>> int ret = -EINVAL; >>>> unsigned int n; >>>> >>> >> >> sorry i did not notice that bevor .. >> there is a >> max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3 >> >> IMHO this should read either: >> int value[max_ints+1]; > > I originally went this route when I refactored the function, however > running make C=1 yields the following warnings: > > drivers/iio/light/tsl2583.c:568:19: warning: Variable length array is > used. > drivers/iio/light/tsl2583.c:574:26: error: cannot size expression > > That is why I went with the current implementation. > >> or >> max_ints=ARRAY_SIZE(value)-1; >> >> (my personal favorite is dropping max_ints completely). > > The max_ints value is also shown in the error message if the user passes > in too many or too few entries in the per device lux table. I wanted the > user to see the maximum allowable number without having to dig through > the kernel source code. Without it, I would have had to duplicate the > TSL2583_MAX_LUX_TABLE_ENTRIES * 3 statement a third time. > > Brian > Hello Brian, thanks for the replay, i have no problem when people so such things intentional but some times people do this unintentional. When i review code, i see it as part of my job to challenge constructs where i get a strange feeling. re, wh ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-11-25 8:53 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20161118140326.GA20458@basecamp.onstation.org>
2016-11-24 13:38 ` [patch] iio: tsl2583: make array large enough Dan Carpenter
2016-11-24 15:48 ` Brian Masney
2016-11-24 16:54 ` walter harms
2016-11-24 17:51 ` Brian Masney
2016-11-24 20:12 ` Jonathan Cameron
2016-11-25 8:53 ` walter harms
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox