Date:   Fri, 19 Nov 2021 17:27:53 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     kbuild@lists.01.org, Kiran K <kiran.k@intel.com>,
        linux-bluetooth@vger.kernel.org
Cc:     lkp@intel.com, kbuild-all@lists.01.org,
        ravishankar.srivatsa@intel.com, chethan.tumkur.narayan@intel.com,
        luiz.von.dentz@intel.com, Kiran K <kiran.k@intel.com>
Subject: Re: [PATCH v3 08/13] Bluetooth: Implement MSFT avdtp open command
Message-ID: <202111190204.lssqaO96-lkp@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20211115064914.2345-8-kiran.k@intel.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?C/cLIZQkRksTSRbtPzcGtqxKOkOMtm4EQQvaeRY4MeZmV/d+8ICT1tfwLhB8?=
 =?us-ascii?Q?vxIooJiJiFbcDQUL6h3wRsnvHd9hunFfvSh9v29ViGeYfiUMapvJZvhEXvG+?=
 =?us-ascii?Q?JSr8JeD/SkOdJ8yRJc6DfgV7e4c7Tf6qxV6nWfHcilWajjq2pI7j+viF48k/?=
 =?us-ascii?Q?LgQaY6FJ7d7ntGKPZrmhVoarkaLVfg/l8Omfcc+DIHPd2i29gga8VPR0+xpd?=
 =?us-ascii?Q?7u8CxtXamoUZV3KnijQRCSGQ9POmo0P9lItpA3VSz5Xn+PRodus5XuF6FrQi?=
 =?us-ascii?Q?5m3aT1rhAj5F28NK5OILS1GplAtPYSxSlJxGsG6nF3/WeyCsq0gEm7kWtUkn?=
 =?us-ascii?Q?u4IySrtb3Wt+Rni3TtaCSJNyaOt7xp6tf3d2Uh3ICptd6hjVaXmNJzGVyogn?=
 =?us-ascii?Q?aCDW698SlhsbAStSJ85w7OsxK/vTJM1tg+/FHrsL4eoNIUmkn8n3lpL12f/R?=
 =?us-ascii?Q?udFpPssLC0qXhW8KNxngsl6IZwEFTqkyLedS+MXEkPDpyOgZ6TICF7WM/ofW?=
 =?us-ascii?Q?CamMJitcVkB3bbz8MN/wmxbH5eWdauJDnlnYWrOVX1nZ7k5CG42akHiFvL7e?=
 =?us-ascii?Q?01wb+srfXid6vMfKIUMct4mWWyk4ZWLQ4r81WDDEFX4muQH8AyUTPMvbpECy?=
 =?us-ascii?Q?CJIuGAXibJ+ddBiPPwgrSqTkP4Umgsdb+rtI+nrlD16zrb/5L0XD+oH3V5+u?=
 =?us-ascii?Q?BQgSUI4TBqz+fMDsq+rAQxDxGApCYq8VN7k/2qIO4gFcmaAiyKc06MRrncbT?=
 =?us-ascii?Q?Fu6US1w5RD8grt0BL0B649gisoHGewS3hdelBC//vjJyoM1z9MDsqGZneddV?=
 =?us-ascii?Q?yrlocx8I++I6uEM6BQW+Naop3CIgidtcUfbjDX1dtEPbZ9Cc09rUmDq4AfHi?=
 =?us-ascii?Q?4r+ywkEGo5t/yayHk/UzNewM6ijoO7vHMF+NzPvM0P9YhZ9cMpMDXmnkGSD+?=
 =?us-ascii?Q?ZzpxIvVTkvrFtZObPXg2sQWqS1tJcYuPGyTP/L2gdBtXk97n9fsO2tMXiNGr?=
 =?us-ascii?Q?AjuLRkqtr92a/GCl3d1vGCQtQmaO2/jHbinQk6k9+mpbNSZiKUACmlESAUNc?=
 =?us-ascii?Q?DYEHthHRm/o1Yi+tKCQk+W0/snu1tygDXAXTQ7ipQjhnMGFXh19IpS/rTHEv?=
 =?us-ascii?Q?zgwrDoa6r8xgUvOtMb2GpeD1bDu+xgEb5s1TKwwx7/0U/8HfIulpn4UxbafL?=
 =?us-ascii?Q?QWTKX9sEO14b5+zfZ/PCsPxCPQPtraQVytS37qp00MccspJRt+nAfAD4wB2+?=
 =?us-ascii?Q?GQ6vO/ikeN5uuCZ1NWrbGJemBn3ELBCDFociFUH2t4DGB+eKocTsTwsIttUu?=
 =?us-ascii?Q?H/sr/Zzj7072/WZwgpjGrjc3pmJxzz7AoNmDKI27Re8G/wjYgkzddoFKmmm5?=
 =?us-ascii?Q?W/Fy3YbBWXgcRuJhDXMnYA2uAdtsRtES4h9y/u3Mw4WJL8wBghkIRwR5tmkX?=
 =?us-ascii?Q?xpxPrUbcLt2vLCU4dX62P5dF/jK7+VHULBFYR6mGxPUVSCTAUXRmiEbZWZk4?=
 =?us-ascii?Q?MMXSJl4VX5EoJwvQKnXm+x1HoUA61H0g1emv3XeyU+gGvqIv2hetDNlxGjcw?=
 =?us-ascii?Q?KXrHOi5D1UyYUcBHCKF6bI2vlsAe9YAPKYUtp6GGtsgkuSFeWPqDrAQZvjL2?=
 =?us-ascii?Q?4Y4G6GuNT8RVgKN1i+iHLp8BRDJhU+RKVC+AvtwJoZmWGoUH/9/IhsqS4Mv1?=
 =?us-ascii?Q?4b2rC93s/oQCcrI3BYtvFiyHrBs=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8d3670f8-ca9e-423a-4d10-08d9ab68cc51
X-MS-Exchange-CrossTenant-AuthSource: BN6PR1001MB2354.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Nov 2021 14:28:18.5692
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 9asYY3TFECztorBi8QnS5HDIvPaJCvFCjI+Re8FONH3YaWOYUZ2+nNIjPolId1KwkU4+9q+lGMeujpzUC4PO52XFIXMXuOh9NuPduw+8Hqg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR1001MB2291
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10172 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0 mlxscore=0
 spamscore=0 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111190080
X-Proofpoint-ORIG-GUID: qDaHj8LFHE8M4LYOEntHuMYdQe7msE2R
X-Proofpoint-GUID: qDaHj8LFHE8M4LYOEntHuMYdQe7msE2R
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Hi Kiran,

url:    https://github.com/0day-ci/linux/commits/Kiran-K/Bluetooth-Refactor-code-to-read-supported-codecs-in-getsockopt/20211115-144640
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
config: i386-randconfig-m021-20211115 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
net/bluetooth/hci_codec.c:388 hci_configure_msft_avdtp_open() warn: is 'cmd + 1' large enough for 'struct hci_media_service_caps'? s32min

Old smatch warnings:
net/bluetooth/hci_codec.c:399 hci_configure_msft_avdtp_open() error: uninitialized symbol 'err'.

vim +388 net/bluetooth/hci_codec.c

d9396dc909768b Kiran K 2021-11-15  359  int hci_configure_msft_avdtp_open(struct hci_dev *hdev, struct l2cap_chan *chan,
d9396dc909768b Kiran K 2021-11-15  360  				  sockptr_t optval, int optlen)
d9396dc909768b Kiran K 2021-11-15  361  {
d9396dc909768b Kiran K 2021-11-15  362  	struct msft_cp_avdtp_open *cmd = NULL;
d9396dc909768b Kiran K 2021-11-15  363  	struct hci_media_service_caps *caps;
d9396dc909768b Kiran K 2021-11-15  364  	int err;
d9396dc909768b Kiran K 2021-11-15  365  
d9396dc909768b Kiran K 2021-11-15  366  	if (!optlen || optlen < sizeof(*caps)) {

The kbuild-bot doesn't use cross function analysis so it doesn't know
how this function is called.  This check doesn't prevent negative values
of "optlen" and the "!optlen" condition is not required.  Of course,
making "optlen" into an unsigned value changes it from a "negatives are
not handled" warning into a "integer overflows are not handled" warning.

One idea would be to just make sure this is called with valid values and
ignore the warning.  It probably should be disabled globally if you
don't have the cross function database.  Another idea would be to
write this as:

	if (optlen < 0 || optlen < sizeof(*caps)) {

Negatives don't really cause a problem though because copy_from_user()
has a check for that added in commit 6d13de1489b6 ("uaccess: disallow >
INT_MAX copy sizes").

regards,
dan carpenter

d9396dc909768b Kiran K 2021-11-15  367  		err = -EINVAL;
d9396dc909768b Kiran K 2021-11-15  368  		goto fail;
d9396dc909768b Kiran K 2021-11-15  369  	}
d9396dc909768b Kiran K 2021-11-15  370  
d9396dc909768b Kiran K 2021-11-15  371  	cmd = kzalloc(sizeof(*cmd) + optlen, GFP_KERNEL);
d9396dc909768b Kiran K 2021-11-15  372  	if (!cmd) {
d9396dc909768b Kiran K 2021-11-15  373  		err = -ENOMEM;
d9396dc909768b Kiran K 2021-11-15  374  		goto fail;
d9396dc909768b Kiran K 2021-11-15  375  	}
d9396dc909768b Kiran K 2021-11-15  376  
d9396dc909768b Kiran K 2021-11-15  377  	cmd->sub_opcode = HCI_MSFT_AVDTP_OPEN;
d9396dc909768b Kiran K 2021-11-15  378  	cmd->handle = __cpu_to_le16(chan->conn->hcon->handle);
d9396dc909768b Kiran K 2021-11-15  379  	cmd->dcid = cpu_to_le16(chan->dcid);
d9396dc909768b Kiran K 2021-11-15  380  	cmd->omtu = cpu_to_le16(chan->omtu);
d9396dc909768b Kiran K 2021-11-15  381  	caps = (void *)(cmd + 1);
d9396dc909768b Kiran K 2021-11-15  382  
d9396dc909768b Kiran K 2021-11-15  383  	if (copy_from_sockptr(caps, optval, optlen)) {
d9396dc909768b Kiran K 2021-11-15  384  		err = -EFAULT;
d9396dc909768b Kiran K 2021-11-15  385  		goto fail;
d9396dc909768b Kiran K 2021-11-15  386  	}
d9396dc909768b Kiran K 2021-11-15  387  
d9396dc909768b Kiran K 2021-11-15 @388  	if (caps->category != 0x07) {

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org