Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address -Warray-bounds issue in drivers/iio/proximity/irsd200.c #331

Closed
GustavoARSilva opened this issue Jul 31, 2023 · 1 comment
Closed

Address -Warray-bounds issue in drivers/iio/proximity/irsd200.c #331

GustavoARSilva opened this issue Jul 31, 2023 · 1 comment
Labels
-Warray-bounds [Linux] v6.6 Released in Linux kernel v6.6

Comments

@GustavoARSilva
Copy link
Collaborator

Found in X86_64 (allmodconfig):

include/linux/iio/buffer.h:42:46: warning: array subscript 'int64_t {aka long long int}[0]' is partly outside array bounds of 's16[1]' {aka 'short int[1]'} [-Warray-bounds=]
drivers/iio/proximity/irsd200.c:
758 static irqreturn_t irsd200_trigger_handler(int irq, void *pollf)
759 {
760         struct iio_dev *indio_dev = ((struct iio_poll_func *)pollf)->indio_dev;
761         struct irsd200_data *data = iio_priv(indio_dev);
@762         s16 buf = 0;
763         int ret;
764 
765         ret = irsd200_read_data(data, &buf);
766         if (ret)
767                 goto end;
768 
@769         iio_push_to_buffers_with_timestamp(indio_dev, &buf,
770                                            iio_get_time_ns(indio_dev));
771 
772 end:
773         iio_trigger_notify_done(indio_dev->trig);
774 
775         return IRQ_HANDLED;
776 }
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Aug 10, 2023
@intel-lab-lkp
iio: irsd200: fix -Warray-bounds bug in irsd200_trigger_handler
e677d0d 
When compiling with gcc 13 with -Warray-bounds enabled:

In file included from drivers/iio/proximity/irsd200.c:15:
In function ‘iio_push_to_buffers_with_timestamp’,
    inlined from ‘irsd200_trigger_handler’ at drivers/iio/proximity/irsd200.c:770:2:
./include/linux/iio/buffer.h:42:46: error: array subscript ‘int64_t {aka long long int}[0]’
is partly outside array bounds of ‘s16[1]’ {aka ‘short int[1]’} [-Werror=array-bounds=]
   42 |                 ((int64_t *)data)[ts_offset] = timestamp;
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
drivers/iio/proximity/irsd200.c: In function ‘irsd200_trigger_handler’:
drivers/iio/proximity/irsd200.c:763:13: note: object ‘buf’ of size 2
  763 |         s16 buf = 0;
      |             ^~~

The problem seems to be that irsd200_trigger_handler() is taking a s16
variable as an int64_t buffer. As Jonathan suggested [1], fix it by
extending the buffer to a two-element array of s64.

Link: KSPP#331
Link: https://lore.kernel.org/lkml/20230809181329.46c00a5d@jic23-huawei/ [1]
Fixes: 3db3562 ("iio: Add driver for Murata IRS-D200")
Signed-off-by: GONG, Ruiqi <[email protected]>
Acked-by: Gustavo A. R. Silva <[email protected]>
akiyks pushed a commit to akiyks/linux that referenced this issue Sep 5, 2023
@jic23
iio: irsd200: fix -Warray-bounds bug in irsd200_trigger_handler
08c8d40 
When compiling with gcc 13 with -Warray-bounds enabled:

In file included from drivers/iio/proximity/irsd200.c:15:
In function ‘iio_push_to_buffers_with_timestamp’,
    inlined from ‘irsd200_trigger_handler’ at drivers/iio/proximity/irsd200.c:770:2:
./include/linux/iio/buffer.h:42:46: error: array subscript ‘int64_t {aka long long int}[0]’
is partly outside array bounds of ‘s16[1]’ {aka ‘short int[1]’} [-Werror=array-bounds=]
   42 |                 ((int64_t *)data)[ts_offset] = timestamp;
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
drivers/iio/proximity/irsd200.c: In function ‘irsd200_trigger_handler’:
drivers/iio/proximity/irsd200.c:763:13: note: object ‘buf’ of size 2
  763 |         s16 buf = 0;
      |             ^~~

The problem seems to be that irsd200_trigger_handler() is taking a s16
variable as an int64_t buffer. As Jonathan suggested [1], fix it by
extending the buffer to a two-element array of s64.

Link: KSPP#331
Link: https://lore.kernel.org/lkml/20230809181329.46c00a5d@jic23-huawei/ [1]
Fixes: 3db3562 ("iio: Add driver for Murata IRS-D200")
Signed-off-by: GONG, Ruiqi <[email protected]>
Acked-by: Gustavo A. R. Silva <[email protected]>
Reviewed-by: Waqar Hameed <[email protected]>
Tested-by: Waqar Hameed <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jonathan Cameron <[email protected]>
roxell pushed a commit to roxell/linux that referenced this issue Oct 6, 2023
@jic23
iio: irsd200: fix -Warray-bounds bug in irsd200_trigger_handler
ea191d0 
When compiling with gcc 13 with -Warray-bounds enabled:

In file included from drivers/iio/proximity/irsd200.c:15:
In function ‘iio_push_to_buffers_with_timestamp’,
    inlined from ‘irsd200_trigger_handler’ at drivers/iio/proximity/irsd200.c:770:2:
./include/linux/iio/buffer.h:42:46: error: array subscript ‘int64_t {aka long long int}[0]’
is partly outside array bounds of ‘s16[1]’ {aka ‘short int[1]’} [-Werror=array-bounds=]
   42 |                 ((int64_t *)data)[ts_offset] = timestamp;
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
drivers/iio/proximity/irsd200.c: In function ‘irsd200_trigger_handler’:
drivers/iio/proximity/irsd200.c:763:13: note: object ‘buf’ of size 2
  763 |         s16 buf = 0;
      |             ^~~

The problem seems to be that irsd200_trigger_handler() is taking a s16
variable as an int64_t buffer. As Jonathan suggested [1], fix it by
extending the buffer to a two-element array of s64.

Link: KSPP#331
Link: https://lore.kernel.org/lkml/20230809181329.46c00a5d@jic23-huawei/ [1]
Fixes: 3db3562 ("iio: Add driver for Murata IRS-D200")
Signed-off-by: GONG, Ruiqi <[email protected]>
Acked-by: Gustavo A. R. Silva <[email protected]>
Reviewed-by: Waqar Hameed <[email protected]>
Tested-by: Waqar Hameed <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jonathan Cameron <[email protected]>
honjow pushed a commit to 3003n/linux that referenced this issue Oct 16, 2023
@honjow
iio: irsd200: fix -Warray-bounds bug in irsd200_trigger_handler
d3949d6 
When compiling with gcc 13 with -Warray-bounds enabled:

In file included from drivers/iio/proximity/irsd200.c:15:
In function ‘iio_push_to_buffers_with_timestamp’,
    inlined from ‘irsd200_trigger_handler’ at drivers/iio/proximity/irsd200.c:770:2:
./include/linux/iio/buffer.h:42:46: error: array subscript ‘int64_t {aka long long int}[0]’
is partly outside array bounds of ‘s16[1]’ {aka ‘short int[1]’} [-Werror=array-bounds=]
   42 |                 ((int64_t *)data)[ts_offset] = timestamp;
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
drivers/iio/proximity/irsd200.c: In function ‘irsd200_trigger_handler’:
drivers/iio/proximity/irsd200.c:763:13: note: object ‘buf’ of size 2
  763 |         s16 buf = 0;
      |             ^~~

The problem seems to be that irsd200_trigger_handler() is taking a s16
variable as an int64_t buffer. As Jonathan suggested [1], fix it by
extending the buffer to a two-element array of s64.

Link: KSPP#331
Link: https://lore.kernel.org/lkml/20230809181329.46c00a5d@jic23-huawei/ [1]
Fixes: 3db3562 ("iio: Add driver for Murata IRS-D200")
Signed-off-by: GONG, Ruiqi <[email protected]>
Acked-by: Gustavo A. R. Silva <[email protected]>
Reviewed-by: Waqar Hameed <[email protected]>
Tested-by: Waqar Hameed <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jonathan Cameron <[email protected]>
strongtz pushed a commit to strongtz/linux-next that referenced this issue Oct 19, 2023
@jic23
iio: irsd200: fix -Warray-bounds bug in irsd200_trigger_handler
84aea87 
When compiling with gcc 13 with -Warray-bounds enabled:

In file included from drivers/iio/proximity/irsd200.c:15:
In function ‘iio_push_to_buffers_with_timestamp’,
    inlined from ‘irsd200_trigger_handler’ at drivers/iio/proximity/irsd200.c:770:2:
./include/linux/iio/buffer.h:42:46: error: array subscript ‘int64_t {aka long long int}[0]’
is partly outside array bounds of ‘s16[1]’ {aka ‘short int[1]’} [-Werror=array-bounds=]
   42 |                 ((int64_t *)data)[ts_offset] = timestamp;
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
drivers/iio/proximity/irsd200.c: In function ‘irsd200_trigger_handler’:
drivers/iio/proximity/irsd200.c:763:13: note: object ‘buf’ of size 2
  763 |         s16 buf = 0;
      |             ^~~

The problem seems to be that irsd200_trigger_handler() is taking a s16
variable as an int64_t buffer. As Jonathan suggested [1], fix it by
extending the buffer to a two-element array of s64.

Link: KSPP/linux#331
Link: https://lore.kernel.org/lkml/20230809181329.46c00a5d@jic23-huawei/ [1]
Fixes: 3db3562 ("iio: Add driver for Murata IRS-D200")
Signed-off-by: GONG, Ruiqi <[email protected]>
Acked-by: Gustavo A. R. Silva <[email protected]>
Reviewed-by: Waqar Hameed <[email protected]>
Tested-by: Waqar Hameed <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jonathan Cameron <[email protected]>
@kees kees added the [Linux] v6.6 Released in Linux kernel v6.6 label Feb 6, 2024
@kees
Copy link

kees commented Feb 6, 2024

Fixed in commit ea191d0.

@kees kees closed this as completed Feb 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
-Warray-bounds [Linux] v6.6 Released in Linux kernel v6.6
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@GustavoARSilva @kees