From patchwork Fri Oct 9 17:13:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?SsOpcsO0bWUgUG91aWxsZXI=?= X-Patchwork-Id: 299177 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, MSGID_FROM_MTA_HEADER, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04AB5C433E7 for ; Fri, 9 Oct 2020 17:14:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BDCF522258 for ; Fri, 9 Oct 2020 17:14:06 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=silabs.onmicrosoft.com header.i=@silabs.onmicrosoft.com header.b="HwpLplVe" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390177AbgJIRNu (ORCPT ); Fri, 9 Oct 2020 13:13:50 -0400 Received: from mail-eopbgr760074.outbound.protection.outlook.com ([40.107.76.74]:48911 "EHLO NAM02-CY1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2390148AbgJIRNp (ORCPT ); Fri, 9 Oct 2020 13:13:45 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NBvYZ73B3kZIPoOowYMaiHN0W+BXoGcFx7j0nlQFrxlg8QtoyL0Rh6A996BCU1+/sI71eQEPJiE8U8zi5JSuYJyNP2ro8WiwDZKWgE5aLXWngrhLFb1LIyfi7L/lRlXXKmtJTOt7MNtK1ScZRyBOIdDybGJ7g71ogp++SPj9xS3zFyjkwhBZTwMao8fywz4v7VXmq1SkyoZNrMd8JfL5XnXR6wJT9nqX1cAFUqyc1EQnN54yG73S8Js/VNQj9ee9IJagi1OM29FR9EQPtT2jq4wpMnKB8lSviuBsm84zUiDv0HlmIyPALF2XXg/fh77FKhTYTSIDvsHEfoZ2wFDIBw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gFamtZ+oLsXr5s+k5oJSr9zgVd2lARoDpqvQrwygSkI=; b=W7UeOmylrbNDKqid79upbMYTMgH+7vJVIqX5HMXsFkyVrCr6H58SHVcRf0izJN20rp78su6R0Cf4DS0NzQvn2tr0tbNNLQcE8W/43+y2ELQUpS/yEUdEPAYzkHBwhGOURgryM4o+RrMVUYdL3CMfcbpASQZUC5VyHDqmj+ld96SkvYUzCZJ/kweAW9dUHe0mX5PP3bMlGHRoxUJVIMCP80KJBKGgufsPrunDn/z5jJlC1wu+Qrj0hQ2e47dBBup+3DEYMQ+Z4+hE7e5GAUDJyooxkhwDzZXC7p5jormf0aHsRlZovvh/Qzncga7tBSXCA3bYEnXwspUoCq2bjjZTAA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=silabs.com; dmarc=pass action=none header.from=silabs.com; dkim=pass header.d=silabs.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=silabs.onmicrosoft.com; s=selector2-silabs-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gFamtZ+oLsXr5s+k5oJSr9zgVd2lARoDpqvQrwygSkI=; b=HwpLplVePJQhgklHZKsiG1LMxP5ro7ZpvMZA6f0alnIaOpMAStVzrtWEkbZbBYx7SEGlPbrZgTpvIOb7cy7hznbGBvVQNkK0YDVmYBLXnT9fOTEXSMynqZ+bQ+jGhGpn3tCKQTeU7XORz+g8olbaEcQCQWR0RAFLyPHmN4A9lHQ= Authentication-Results: driverdev.osuosl.org; dkim=none (message not signed) header.d=none; driverdev.osuosl.org; dmarc=none action=none header.from=silabs.com; Received: from SN6PR11MB2718.namprd11.prod.outlook.com (2603:10b6:805:63::18) by SN6PR11MB3455.namprd11.prod.outlook.com (2603:10b6:805:bb::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3455.22; Fri, 9 Oct 2020 17:13:32 +0000 Received: from SN6PR11MB2718.namprd11.prod.outlook.com ([fe80::4f5:fbe5:44a7:cb8a]) by SN6PR11MB2718.namprd11.prod.outlook.com ([fe80::4f5:fbe5:44a7:cb8a%5]) with mapi id 15.20.3455.024; Fri, 9 Oct 2020 17:13:32 +0000 From: Jerome Pouiller To: devel@driverdev.osuosl.org, linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Kalle Valo , "David S . Miller" , Dan Carpenter , =?utf-8?b?SsOpcsO0bWUgUG91?= =?utf-8?q?iller?= Subject: [PATCH 5/8] staging: wfx: increase robustness of hif_generic_confirm() Date: Fri, 9 Oct 2020 19:13:04 +0200 Message-Id: <20201009171307.864608-6-Jerome.Pouiller@silabs.com> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201009171307.864608-1-Jerome.Pouiller@silabs.com> References: <20201009171307.864608-1-Jerome.Pouiller@silabs.com> X-Originating-IP: [82.67.86.106] X-ClientProxiedBy: SA9PR10CA0004.namprd10.prod.outlook.com (2603:10b6:806:a7::9) To SN6PR11MB2718.namprd11.prod.outlook.com (2603:10b6:805:63::18) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from pc-42.silabs.com (82.67.86.106) by SA9PR10CA0004.namprd10.prod.outlook.com (2603:10b6:806:a7::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3455.24 via Frontend Transport; Fri, 9 Oct 2020 17:13:30 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 55c31237-5da1-4da5-1254-08d86c76a5cc X-MS-TrafficTypeDiagnostic: SN6PR11MB3455: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2399; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: k6xJxDPNrx1xeQSJ4CvK7qH4MKNdh3mDrbKkZsn60S/4dskwe+xHxZG7au/IsrdFBeUJfv5uusZyyIQVWqeULFd6MTkX1Kd0AZUEk7oadXQkbtVTwGHaaD1we53uMNPSTZQhLbYvfugAS7uicw62wVCXo4+yKkPK6bzZg9/AKfC06wpPW/rmDSbS2/W44bs+jn+VL2IQA/BVb/Jw722cXzntnVrh5914ZutoGqMcs0rfPB83cSgxfFoCPchi+dejQNmXMeH1yr/r9JYdWdc3dtzKSeW5F77r+SRlOm2iMwXNeC1UQ/A8P+GKNGdZdtv3DXEnOIUqKAHto6vd89HW+zkqIPU/ZrnyOO96wJhjq2PH0f7Qcx0WCygvRKdnb5aE X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SN6PR11MB2718.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(346002)(376002)(39850400004)(396003)(136003)(8936002)(36756003)(54906003)(1076003)(316002)(52116002)(7696005)(2906002)(5660300002)(478600001)(66574015)(86362001)(4326008)(66946007)(66556008)(66476007)(6666004)(107886003)(26005)(16526019)(2616005)(83380400001)(186003)(8676002)(956004)(6486002)(41533002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: D/38gC1g/3u8VoaBRMtRZf748kKMNequ7C0RWSafUyF+xvZo+3nKSTnmj7HQbdABVU6eZssim7N05nB8cmDAEzYZYpKPk3zCxseAG+euJizQGK617uWkevyfK+OyZdTCrqCWE3gsM3NmosWImBTG3ntRC8Wih6cJh5A5PDQfI8KaNilLaRXw5fzeKdHUg+VFKtczTZtPO26g1PJ1TtcvafXQhi5B2esyQoqfsZTQM/CIVoyVq8vINAAPneC1j5yyd2Ko5VoSMW/oKw9Gfp751u0C9LiZwi9FZdRC8Rp0o6bgF0RO4PCtvhUTjKtVXWIjnEmugsRu4SEgERBH0myE/Q3R+3H4iiwnWYC1YxGW/Cx7YPtqemWtlkgAeaPhw3+MZD124n1kpnpfacW5R6GSKKAG9YXhH6q+HaeDTVabsaHC5Qu6pM2SBFxGowB3MwLlYwZyZYJeEHrySbXlzdgmY/NX+7DdryVXLrg1ohNw841UUmoswxRn8cxo4a6pBXauP6xR6KWE/G5nJMTce4xM0l8e9rWHV/ZM8z1Jvo8R4jlBRVU5WnhN5BSYShDALXPCenthBNIVmcvQQQ1j0TgH154yGG0XlrdiRQWJq0iGPKEQG8+cWExt8PwJylM3rTBZkjZidIoVn/SfBBkNrB2Aug== X-OriginatorOrg: silabs.com X-MS-Exchange-CrossTenant-Network-Message-Id: 55c31237-5da1-4da5-1254-08d86c76a5cc X-MS-Exchange-CrossTenant-AuthSource: SN6PR11MB2718.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2020 17:13:31.9428 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 54dbd822-5231-4b20-944d-6f4abcd541fb X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: wIrH+nz/bqRtteRt8XjzqJIWDN5CSghEBWEnPqBivvyCnHZKCGeC/B4uD5xVEFn+I5TnqUF9ygGVuvEA20FfAg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR11MB3455 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Jérôme Pouiller Smatch complains: drivers/staging/wfx/hif_rx.c:26 hif_generic_confirm() warn: negative user subtract: 0-u16max - 4 20 static int hif_generic_confirm(struct wfx_dev *wdev, 21 const struct hif_msg *hif, const void *buf) 22 { 23 // All confirm messages start with status 24 int status = le32_to_cpup((__le32 *)buf); 25 int cmd = hif->id; 26 int len = le16_to_cpu(hif->len) - 4; // drop header ^^^^^ 27 28 WARN(!mutex_is_locked(&wdev->hif_cmd.lock), "data locking error"); In fact, rx_helper() already make the necessary checks on the value of hif->len. Never mind, add an explicit check to make Smatch happy. Reported-by: Dan Carpenter Signed-off-by: Jérôme Pouiller --- drivers/staging/wfx/hif_rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/wfx/hif_rx.c b/drivers/staging/wfx/hif_rx.c index ca09467cba05..2d4265257112 100644 --- a/drivers/staging/wfx/hif_rx.c +++ b/drivers/staging/wfx/hif_rx.c @@ -40,10 +40,10 @@ static int hif_generic_confirm(struct wfx_dev *wdev, } if (wdev->hif_cmd.buf_recv) { - if (wdev->hif_cmd.len_recv >= len) + if (wdev->hif_cmd.len_recv >= len && len > 0) memcpy(wdev->hif_cmd.buf_recv, buf, len); else - status = -ENOMEM; + status = -EIO; } wdev->hif_cmd.ret = status;