Re: [PATCH v2 1/2] media: az6007: fix out-of-bounds in az6007_i2c_xfer()

[kernel test robot <lkp@intel.com>]

Hi Jeongjun,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linuxtv-media-pending/master]
[also build test WARNING on linus/master v6.17-rc5 next-20250908]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Jeongjun-Park/media-az6007-fix-out-of-bounds-in-az6007_i2c_xfer/20250908-231026
base:   https://git.linuxtv.org/media-ci/media-pending.git master
patch link:    https://lore.kernel.org/r/20250908150730.24560-2-aha310510%40gmail.com
patch subject: [PATCH v2 1/2] media: az6007: fix out-of-bounds in az6007_i2c_xfer()
config: hexagon-allyesconfig (https://download.01.org/0day-ci/archive/20250909/202509091306.eGl2abHr-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 7fb1dc08d2f025aad5777bb779dfac1197e9ef87)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250909/202509091306.eGl2abHr-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509091306.eGl2abHr-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/media/usb/dvb-usb-v2/az6007.c:107:16: warning: format specifies type 'unsigned long' but the argument has type '__size_t' (aka 'unsigned int') [-Wformat]
     106 |                 pr_err("az6007: tried to read %d bytes, but I2C max size is %lu bytes\n",
         |                                                                             ~~~
         |                                                                             %zu
     107 |                        blen, sizeof(st->data));
         |                              ^~~~~~~~~~~~~~~~
   include/linux/printk.h:557:33: note: expanded from macro 'pr_err'
     557 |         printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
         |                                ~~~     ^~~~~~~~~~~
   include/linux/printk.h:514:60: note: expanded from macro 'printk'
     514 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
         |                                                     ~~~    ^~~~~~~~~~~
   include/linux/printk.h:486:19: note: expanded from macro 'printk_index_wrap'
     486 |                 _p_func(_fmt, ##__VA_ARGS__);                           \
         |                         ~~~~    ^~~~~~~~~~~
   drivers/media/usb/dvb-usb-v2/az6007.c:154:16: warning: format specifies type 'unsigned long' but the argument has type '__size_t' (aka 'unsigned int') [-Wformat]
     153 |                 pr_err("az6007: tried to write %d bytes, but I2C max size is %lu bytes\n",
         |                                                                              ~~~
         |                                                                              %zu
     154 |                        blen, sizeof(st->data));
         |                              ^~~~~~~~~~~~~~~~
   include/linux/printk.h:557:33: note: expanded from macro 'pr_err'
     557 |         printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
         |                                ~~~     ^~~~~~~~~~~
   include/linux/printk.h:514:60: note: expanded from macro 'printk'
     514 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
         |                                                     ~~~    ^~~~~~~~~~~
   include/linux/printk.h:486:19: note: expanded from macro 'printk_index_wrap'
     486 |                 _p_func(_fmt, ##__VA_ARGS__);                           \
         |                         ~~~~    ^~~~~~~~~~~
   2 warnings generated.


vim +107 drivers/media/usb/dvb-usb-v2/az6007.c

    99	
   100	static int __az6007_read(struct usb_device *udev, struct az6007_device_state *st,
   101				    u8 req, u16 value, u16 index, u8 *b, int blen)
   102	{
   103		int ret;
   104	
   105		if (blen > sizeof(st->data)) {
   106			pr_err("az6007: tried to read %d bytes, but I2C max size is %lu bytes\n",
 > 107			       blen, sizeof(st->data));
   108			return -EOPNOTSUPP;
   109		}
   110	
   111		ret = usb_control_msg(udev,
   112				      usb_rcvctrlpipe(udev, 0),
   113				      req,
   114				      USB_TYPE_VENDOR | USB_DIR_IN,
   115				      value, index, b, blen, 5000);
   116		if (ret < 0) {
   117			pr_warn("usb read operation failed. (%d)\n", ret);
   118			return -EIO;
   119		}
   120	
   121		if (az6007_xfer_debug) {
   122			printk(KERN_DEBUG "az6007: IN  req: %02x, value: %04x, index: %04x\n",
   123			       req, value, index);
   124			print_hex_dump_bytes("az6007: payload: ",
   125					     DUMP_PREFIX_NONE, b, blen);
   126		}
   127	
   128		return ret;
   129	}
   130	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki