Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-14 23:25:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
845b978a87
linux/drivers
History
Mauro Carvalho Chehab 845b978a87 media: rtl28xxu: be sure that it won't go past the array size 
smatch warns that the RC query code could go past the array size:

	drivers/media/usb/dvb-usb-v2/rtl28xxu.c:1757 rtl2832u_rc_query() error: buffer overflow 'buf' 128 <= 130
	drivers/media/usb/dvb-usb-v2/rtl28xxu.c:1758 rtl2832u_rc_query() error: buffer overflow 'buf' 128 <= 130

The driver logic gets the length of the IR RX buffer with:

        ret = rtl28xxu_rd_reg(d, IR_RX_BC, &buf[0]);
	...
        len = buf[0];

In thesis, this could range between 0 and 255 [1].

While this should never happen in practice, due to hardware limits,
smatch is right when it complains about that, as there's nothing at
the logic that would prevent it. So, if for whatever reason, buf[0]
gets filled by rtl28xx read functions with a value bigger than 128,
it will go past the array.

So, add an explicit check.

[1] I've no idea why smatch thinks that the maximum value is 130.
I double-checked the code several times. Was unable to find any
reason for assuming 130. Perhaps smatch is not properly parsing
u8 here?

Fixes: b5cbaa43a6 ("[media] rtl28xx: initial support for rtl2832u")
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-08-08 10:57:14 -04:00
..
accessibility
acpi Merge branches 'acpi-soc' and 'acpi-processor' 2018-06-21 14:19:08 +02:00
amba Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm 2018-06-06 13:49:25 -07:00
android treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
ata treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
atm treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
auxdisplay treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
base Power management changes for 4.18-rc2 2018-06-22 05:57:36 +09:00
bcma dma-mapping updates for 4.18: 2018-06-04 10:58:12 -07:00
block for-linus-20180623 2018-06-24 06:33:54 +08:00
bluetooth bluetooth: hci_nokia: Don't include linux/unaligned/le_struct.h directly. 2018-06-17 08:38:55 +09:00
bus - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
cdrom treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
char Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-06-24 06:31:54 +08:00
clk docs: Fix some broken references 2018-06-15 18:10:01 -03:00
clocksource Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-06-24 19:16:42 +08:00
connector Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-06-06 18:39:49 -07:00
cpufreq cpufreq: intel_pstate: Fix scaling max/min limits with Turbo 3.0 2018-06-19 10:40:29 +02:00
cpuidle powerpc updates for 4.18 2018-06-07 10:23:33 -07:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-06-24 06:31:54 +08:00
dax libnvdimm for 4.18 2018-06-08 17:21:52 -07:00
dca
devfreq treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
dio
dma fix a series of Documentation/ broken file name references 2018-06-15 18:10:01 -03:00
dma-buf
edac treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
eisa
extcon treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
firewire treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
firmware media: headers: fix linux/mod_devicetable.h inclusions 2018-08-02 18:30:54 -04:00
fmc treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
fpga
fsi
gpio treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
gpu Fixes for v4.18-rc2: 2018-06-22 11:03:43 +10:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2018-06-20 16:42:39 +09:00
hsi
hv treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
hwmon hwmon: (nct6775) Fix loop limit 2018-06-16 16:40:36 -07:00
hwspinlock hwspinlock updates for v4.18 2018-06-11 12:09:19 -07:00
hwtracing treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
i2c Merge branch 'i2c/for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-06-14 16:21:46 +09:00
ide treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
idle
iio treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
infiniband 4.18-rc 2018-06-21 07:22:30 +09:00
input docs: Fix some broken references 2018-06-15 18:10:01 -03:00
iommu - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
ipack treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
irqchip irqchip/gic-v3-its: Fix reprogramming of redistributors on CPU hotplug 2018-06-22 14:22:02 +02:00
isdn treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
leds treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
lightnvm for-linus-20180623 2018-06-24 06:33:54 +08:00
macintosh powerpc updates for 4.18 2018-06-07 10:23:33 -07:00
mailbox treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
mcb
md docs: Fix some broken references 2018-06-15 18:10:01 -03:00
media media: rtl28xxu: be sure that it won't go past the array size 2018-08-08 10:57:14 -04:00
memory - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
memstick treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
message treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
mfd Merge branch 'i2c/for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-06-14 16:21:46 +09:00
misc Merge branch 'i2c/for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-06-14 16:21:46 +09:00
mmc treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
mtd - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
mux
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-06-21 07:13:42 +09:00
nfc treewide: devm_kmalloc() -> devm_kmalloc_array() 2018-06-12 16:19:22 -07:00
ntb - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
nubus Char/Misc driver patches for 4.18-rc1 2018-06-05 16:20:22 -07:00
nvdimm Merge branch 'for-4.18/mcsafe' into libnvdimm-for-next 2018-06-08 15:16:44 -07:00
nvme nvme-pci: limit max IO size and segments to avoid high order allocations 2018-06-21 18:59:46 +02:00
nvmem treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
of - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
opp PM / OPP: Update voltage in case freq == old_freq 2018-06-19 15:53:32 +05:30
oprofile treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
parisc dma-mapping updates for 4.18: 2018-06-04 10:58:12 -07:00
parport docs: Fix some broken references 2018-06-15 18:10:01 -03:00
pci - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
pcmcia treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
perf
phy Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-06-06 18:39:49 -07:00
pinctrl pinctrl: mt7622: fix a kernel panic when pio don't work as EINT controller 2018-06-18 07:55:57 +02:00
platform media: headers: fix linux/mod_devicetable.h inclusions 2018-08-02 18:30:54 -04:00
pnp media updates for v4.18-rc1 2018-06-07 12:34:37 -07:00
power treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
powercap treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
pps
ps3
ptp ptp: replace getnstimeofday64() with ktime_get_real_ts64() 2018-06-20 07:59:53 +09:00
pwm pwm: Changes for v4.18-rc1 2018-06-14 16:25:43 +09:00
rapidio treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
ras
regulator treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
remoteproc treewide: use PHYS_ADDR_MAX to avoid type casting ULLONG_MAX 2018-06-15 07:55:25 +09:00
reset - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
rpmsg rpmsg: smd: do not use mananged resources for endpoints and channels 2018-06-04 12:35:03 -07:00
rtc - New Device Support 2018-06-11 07:20:17 -07:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2018-06-19 07:44:51 +09:00
sbus fix a series of Documentation/ broken file name references 2018-06-15 18:10:01 -03:00
scsi for-linus-20180623 2018-06-24 06:33:54 +08:00
sfi
sh treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
siox
slimbus treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
sn
soc treewide: use PHYS_ADDR_MAX to avoid type casting ULLONG_MAX 2018-06-15 07:55:25 +09:00
soundwire docs: Fix more broken references 2018-06-15 18:11:26 -03:00
spi treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
spmi
ssb
staging media: imx: shut up a false positive warning 2018-08-07 05:52:36 -04:00
target treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
tc
tee
thermal - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
thunderbolt
tty vfs/y2038: inode timestamps conversion to timespec64 2018-06-15 07:31:07 +09:00
uio treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
usb vfs/y2038: inode timestamps conversion to timespec64 2018-06-15 07:31:07 +09:00
uwb treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
vfio VFIO updates for v4.18 2018-06-12 13:11:26 -07:00
vhost virtio, vhost: features, fixes 2018-06-16 06:35:02 +09:00
video media: omap2: omapfb: fix bugon.cocci warnings 2018-08-02 19:01:38 -04:00
virt treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
virtio virtio, vhost: features, fixes 2018-06-16 06:35:02 +09:00
visorbus
vlynq
vme
w1 Char/Misc driver patches for 4.18-rc1 2018-06-05 16:20:22 -07:00
watchdog MIPS changes for 4.18 2018-06-12 12:56:02 -07:00
xen xen: fixes for 4.18-rc2 2018-06-23 20:44:11 +08:00
zorro - Introduce arithmetic overflow test helper functions (Rasmus) 2018-06-06 17:27:14 -07:00
Kconfig
Makefile