From: Michael Zaidman <michael.zaidman@gmail.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: linux-i2c@vger.kernel.org, linux-input@vger.kernel.org,
michael.zaidman@gmail.com
Subject: Re: [bug report] HID: ft260: add usb hid to i2c host bridge driver
Date: Sat, 10 Apr 2021 15:27:29 +0300 [thread overview]
Message-ID: <20210410122729.GA6136@michael-VirtualBox> (raw)
In-Reply-To: <YHBJRvcOSaM/b0RL@mwanda>
On Fri, Apr 09, 2021 at 03:32:06PM +0300, Dan Carpenter wrote:
> Hello Michael Zaidman,
>
> The patch 6a82582d9fa4: "HID: ft260: add usb hid to i2c host bridge
> driver" from Feb 19, 2021, leads to the following static checker
> warning:
>
> drivers/hid/hid-ft260.c:441 ft260_smbus_write()
> error: '__memcpy()' '&rep->data[1]' too small (59 vs 255)
>
> drivers/hid/hid-ft260.c
> 423 static int ft260_smbus_write(struct ft260_device *dev, u8 addr, u8 cmd,
> 424 u8 *data, u8 data_len, u8 flag)
> 425 {
> 426 int ret = 0;
> 427 int len = 4;
> 428
> 429 struct ft260_i2c_write_request_report *rep =
> 430 (struct ft260_i2c_write_request_report *)dev->write_buf;
> 431
> 432 rep->address = addr;
> 433 rep->data[0] = cmd;
> 434 rep->length = data_len + 1;
> 435 rep->flag = flag;
> 436 len += rep->length;
> 437
> 438 rep->report = FT260_I2C_DATA_REPORT_ID(len);
> 439
> 440 if (data_len > 0)
> 441 memcpy(&rep->data[1], data, data_len);
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Smatch says that this can be called from the i2cdev_ioctl_smbus()
> function.
Hi Dan,
This is an example of a false-positive static checker warning.
The maximum data size that the i2cdev_ioctl_smbus() can pass to the
i2c_smbus_xfer() is sizeof(data->block) which is (I2C_SMBUS_BLOCK_MAX + 2)
or 34 bytes. Thus, no need to check the data_len against 59 here.
Regrads,
Michael
>
> i2cdev_ioctl_smbus()
> --> i2c_smbus_xfer
> --> __i2c_smbus_xfer
> --> ft260_smbus_xfer
> --> ft260_smbus_write
>
> 442
> 443 ft260_dbg("rep %#02x addr %#02x cmd %#02x datlen %d replen %d\n",
> 444 rep->report, addr, cmd, rep->length, len);
> 445
> 446 ret = ft260_hid_output_report_check_status(dev, (u8 *)rep, len);
> 447
> 448 return ret;
> 449 }
>
> regards,
> dan carpenter
next prev parent reply other threads:[~2021-04-10 12:27 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-09 12:32 [bug report] HID: ft260: add usb hid to i2c host bridge driver Dan Carpenter
2021-04-10 12:27 ` Michael Zaidman [this message]
2021-04-10 15:37 ` Dan Carpenter
2021-04-10 21:04 ` Michael Zaidman
2021-04-12 9:11 ` Dan Carpenter
2021-04-13 15:52 ` Michael Zaidman
-- strict thread matches above, loose matches on Subject: below --
2021-03-18 10:39 Dan Carpenter
2021-03-19 16:33 ` Michael Zaidman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210410122729.GA6136@michael-VirtualBox \
--to=michael.zaidman@gmail.com \
--cc=dan.carpenter@oracle.com \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-input@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.