Re: [PATCH v2 4/4] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
From: kernel test robot
Date: Tue Jun 20 2023 - 02:07:55 EST
Hi William,
kernel test robot noticed the following build warnings:
[auto build test WARNING on mtd/nand/next]
[also build test WARNING on linus/master v6.4-rc7 next-20230619]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/William-Zhang/mtd-rawnand-brcmnand-Fix-ECC-level-field-setting-for-v7-2-controller/20230617-103050
base: https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git nand/next
patch link: https://lore.kernel.org/r/20230617022920.67173-5-william.zhang%40broadcom.com
patch subject: [PATCH v2 4/4] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
config: arm64-randconfig-s043-20230619 (https://download.01.org/0day-ci/archive/20230620/202306201340.C2Y4kmFL-lkp@xxxxxxxxx/config)
compiler: aarch64-linux-gcc (GCC) 12.3.0
reproduce: (https://download.01.org/0day-ci/archive/20230620/202306201340.C2Y4kmFL-lkp@xxxxxxxxx/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202306201340.C2Y4kmFL-lkp@xxxxxxxxx/
sparse warnings: (new ones prefixed by >>)
>> drivers/mtd/nand/raw/brcmnand/brcmnand.c:1500:54: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned int [usertype] data @@ got restricted __be32 [usertype] @@
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1500:54: sparse: expected unsigned int [usertype] data
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1500:54: sparse: got restricted __be32 [usertype]
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32
drivers/mtd/nand/raw/brcmnand/brcmnand.c:2065:41: sparse: sparse: dubious: x | !y
vim +1500 drivers/mtd/nand/raw/brcmnand/brcmnand.c
1468
1469 /*
1470 * write_oob_to_regs - write data to OOB registers
1471 * @i: sub-page sector index
1472 * @oob: buffer to write from
1473 * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1474 * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1475 */
1476 static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
1477 const u8 *oob, int sas, int sector_1k)
1478 {
1479 int tbytes = sas << sector_1k;
1480 int j, k = 0;
1481 u32 last = 0xffffffff;
1482 u8 *plast = (u8 *)&last;
1483
1484 /* Adjust OOB values for 1K sector size */
1485 if (sector_1k && (i & 0x01))
1486 tbytes = max(0, tbytes - (int)ctrl->max_oob);
1487 tbytes = min_t(int, tbytes, ctrl->max_oob);
1488
1489 for (j = 0; (j + 3) < tbytes; j += 4)
1490 oob_reg_write(ctrl, j,
1491 (oob[j + 0] << 24) |
1492 (oob[j + 1] << 16) |
1493 (oob[j + 2] << 8) |
1494 (oob[j + 3] << 0));
1495
1496 while (j < tbytes)
1497 plast[k++] = oob[j++];
1498
1499 if (tbytes & 0x3)
> 1500 oob_reg_write(ctrl, (tbytes & ~0x3), cpu_to_be32(last));
1501
1502 return tbytes;
1503 }
1504
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki