public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@linaro.org>
To: Stephan Gerhold <stephan@gerhold.net>
Cc: Johannes Berg <johannes@sipsolutions.net>,
	netdev@vger.kernel.org, linux-arm-msm@vger.kernel.org,
	linux-kernel <linux-kernel@vger.kernel.org>
Subject: [bug report] net: wwan: Add Qualcomm BAM-DMUX WWAN network driver
Date: Fri, 6 Feb 2026 16:38:30 +0300	[thread overview]
Message-ID: <aYXu1uXRG1KHrKej@stanley.mountain> (raw)
In-Reply-To: <caa37f28-a2e8-4e0a-a9ce-a365ce805e4b@stanley.mountain>

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Stephan Gerhold,

Commit 21a0ffd9b38c ("net: wwan: Add Qualcomm BAM-DMUX WWAN network
driver") from Nov 27, 2021 (linux-next), leads to the following
Smatch static checker warning:

	drivers/net/wwan/qcom_bam_dmux.c:505 bam_dmux_cmd_data()
	error: buffer overflow 'dmux->netdevs' 8 <= 255 user_rl='0-255' uncapped

drivers/net/wwan/qcom_bam_dmux.c
    500 static void bam_dmux_cmd_data(struct bam_dmux_skb_dma *skb_dma)
    501 {
    502         struct bam_dmux *dmux = skb_dma->dmux;
    503         struct sk_buff *skb = skb_dma->skb;
    504         struct bam_dmux_hdr *hdr = (struct bam_dmux_hdr *)skb->data;
--> 505         struct net_device *netdev = dmux->netdevs[hdr->ch];
                                                          ^^^^^^^
Smatch thinks skb->data is untrusted.  This is the rx path.

    506 
    507         if (!netdev || !netif_running(netdev)) {
    508                 dev_warn(dmux->dev, "Data for inactive channel %u\n", hdr->ch);
    509                 return;
    510         }
    511 

regards,
dan carpenter

  parent reply	other threads:[~2026-02-06 13:38 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <caa37f28-a2e8-4e0a-a9ce-a365ce805e4b@stanley.mountain>
2026-02-06 13:38 ` [bug report] net: ethtool: Introduce per-PHY DUMP operations Dan Carpenter
2026-02-06 17:04   ` Maxime Chevallier
2026-02-09  7:09     ` Dan Carpenter
2026-02-09  8:09       ` Maxime Chevallier
2026-02-09 13:10         ` Andrew Lunn
2026-02-10 10:37           ` Dan Carpenter
2026-02-06 13:38 ` Dan Carpenter [this message]
2026-02-06 15:12   ` [bug report] net: wwan: Add Qualcomm BAM-DMUX WWAN network driver Stephan Gerhold
2026-02-06 15:23     ` Dan Carpenter
2026-02-06 13:39 ` [bug report] net: ethernet: ti: am65-cpsw: enable bc/mc storm prevention support Dan Carpenter
2026-02-06 13:41 ` [bug report] xfrm: always fail xfrm_dev_{state,policy}_flush_secctx_check() Dan Carpenter
2026-02-06 14:05   ` Tetsuo Handa

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aYXu1uXRG1KHrKej@stanley.mountain \
    --to=dan.carpenter@linaro.org \
    --cc=johannes@sipsolutions.net \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stephan@gerhold.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox