Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752241AbdG1QIO (ORCPT ); Fri, 28 Jul 2017 12:08:14 -0400 Received: from mail-lf0-f52.google.com ([209.85.215.52]:35047 "EHLO mail-lf0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751949AbdG1QIN (ORCPT ); Fri, 28 Jul 2017 12:08:13 -0400 From: "Niklas =?iso-8859-1?Q?S=F6derlund?=" X-Google-Original-From: Niklas =?iso-8859-1?Q?S=F6derlund?= Date: Fri, 28 Jul 2017 18:08:09 +0200 To: Arnd Bergmann Cc: Vinod Koul , Dan Williams , Laurent Pinchart , Geert Uytterhoeven , Kuninori Morimoto , dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] dmaengine: rcar-dmac: avoid array overflow Message-ID: <20170728160809.GC9876@bigcity.dyn.berto.se> References: <20170728131613.122505-1-arnd@arndb.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20170728131613.122505-1-arnd@arndb.de> User-Agent: Mutt/1.8.2 (2017-04-18) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1520 Lines: 45 Hi Arnd, On 2017-07-28 15:15:49 +0200, Arnd Bergmann wrote: > Building with CONFIG_UBSAN_SANITIZE_ALL shows this warning: > > drivers/dma/sh/rcar-dmac.c: In function 'rcar_dmac_chan_prep_sg': > drivers/dma/sh/rcar-dmac.c:839:29: error: array subscript is above array bounds [-Werror=array-bounds] > desc->chcr = chcr | chcr_ts[desc->xfer_shift]; > > As the compiler doesn't know what the xfer_size is, it is impossible > to rule out the array overflow here. As we know that xfer_size > can only be within enum dma_slave_buswidth, this will not overflow > for correct users, and adding a range check will handle the > obscure case and shut up the warning. > > Fixes: 87244fe5abdf ("dmaengine: rcar-dmac: Add Renesas R-Car Gen2 DMA Controller (DMAC) driver") > Signed-off-by: Arnd Bergmann Reviewed-by: Niklas S?derlund > --- > drivers/dma/sh/rcar-dmac.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c > index ffcadca53243..f5b28eb4009e 100644 > --- a/drivers/dma/sh/rcar-dmac.c > +++ b/drivers/dma/sh/rcar-dmac.c > @@ -836,7 +836,8 @@ static void rcar_dmac_chan_configure_desc(struct rcar_dmac_chan *chan, > } > > desc->xfer_shift = ilog2(xfer_size); > - desc->chcr = chcr | chcr_ts[desc->xfer_shift]; > + if (desc->xfer_shift < ARRAY_SIZE(chcr_ts)) > + desc->chcr = chcr | chcr_ts[desc->xfer_shift]; > } > > /* > -- > 2.9.0 > -- Regards, Niklas S?derlund