From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
Date: Mon, 13 Jul 2026 11:05:51 +0800 [thread overview]
Message-ID: <202607131009.D6sc9jsR-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Marco Elver <elver@google.com>
CC: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
CC: "Harry Yoo (Oracle)" <harry@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 44696aa3a489d2baf58efa61b37833f100072bee
commit: feb662d9168b63e1d4c02671ec96005410c6f3ce slab: support for compiler-assisted type-based slab cache partitioning
date: 9 weeks ago
:::::: branch date: 27 hours ago
:::::: commit date: 9 weeks ago
config: i386-randconfig-r071-20260713 (https://download.01.org/0day-ci/archive/20260713/202607131009.D6sc9jsR-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607131009.D6sc9jsR-lkp@intel.com/
smatch warnings:
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
drivers/platform/chrome/cros_ec_chardev.c:285 cros_ec_chardev_ioctl_xcmd() warn: potential user controlled sizeof overflow '(null)' '20 + 0-u32max'
vim +285 drivers/platform/chrome/cros_ec_chardev.c
96a0a80738461d Enric Balletbo i Serra 2019-09-02 268
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 269 /*
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 270 * Ioctls
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 271 */
032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 272 static long cros_ec_chardev_ioctl_xcmd(struct chardev_priv *priv, void __user *arg)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 273 {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 274 struct cros_ec_command *s_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 275 struct cros_ec_command u_cmd;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 276 long ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 277
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 278 if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 279 return -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 280
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 281 if (u_cmd.outsize > EC_MAX_MSG_BYTES ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 282 u_cmd.insize > EC_MAX_MSG_BYTES)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 283 return -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 284
b20cf3f89c56b5 Tzung-Bi Shih 2023-03-24 @285 s_cmd = kzalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize),
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 286 GFP_KERNEL);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 287 if (!s_cmd)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 288 return -ENOMEM;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 289
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 290 if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + u_cmd.outsize)) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 291 ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 292 goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 293 }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 294
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 295 if (u_cmd.outsize != s_cmd->outsize ||
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 296 u_cmd.insize != s_cmd->insize) {
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 297 ret = -EINVAL;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 298 goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 299 }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 300
032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 301 s_cmd->command += priv->cmd_offset;
032c59c1d3cd45 Tzung-Bi Shih 2025-07-21 302 ret = cros_ec_cmd_xfer(priv->ec_dev, s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 303 /* Only copy data to userland if data was received. */
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 304 if (ret < 0)
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 305 goto exit;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 306
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 307 if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 308 ret = -EFAULT;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 309 exit:
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 310 kfree(s_cmd);
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 311 return ret;
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 312 }
eda2e30c6684d6 Enric Balletbo i Serra 2019-09-02 313
:::::: The code at line 285 was first introduced by commit
:::::: b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
:::::: TO: Tzung-Bi Shih <tzungbi@kernel.org>
:::::: CC: Tzung-Bi Shih <tzungbi@kernel.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-07-13 3:06 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607131009.D6sc9jsR-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox