lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 636/846] w1: Misuse of get_user()/put_user() reported by sparse
    Date
    From: Christophe Leroy <christophe.leroy@csgroup.eu>

    [ Upstream commit 33dc3e3e99e626ce51f462d883b05856c6c30b1d ]

    sparse warnings: (new ones prefixed by >>)
    >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@
    drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr
    drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf
    >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@
    drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr
    drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf

    The buffer buf is a failsafe buffer in kernel space, it's not user
    memory hence doesn't deserve the use of get_user() or put_user().

    Access 'buf' content directly.

    Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/
    Reported-by: kernel test robot <lkp@intel.com>
    Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
    Link: https://lore.kernel.org/r/d14ed8d71ad4372e6839ae427f91441d3ba0e94d.1637946316.git.christophe.leroy@csgroup.eu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/w1/slaves/w1_ds28e04.c | 26 ++++++--------------------
    1 file changed, 6 insertions(+), 20 deletions(-)

    diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c
    index e4f336111edc6..6cef6e2edb892 100644
    --- a/drivers/w1/slaves/w1_ds28e04.c
    +++ b/drivers/w1/slaves/w1_ds28e04.c
    @@ -32,7 +32,7 @@ static int w1_strong_pullup = 1;
    module_param_named(strong_pullup, w1_strong_pullup, int, 0);

    /* enable/disable CRC checking on DS28E04-100 memory accesses */
    -static char w1_enable_crccheck = 1;
    +static bool w1_enable_crccheck = true;

    #define W1_EEPROM_SIZE 512
    #define W1_PAGE_COUNT 16
    @@ -339,32 +339,18 @@ static BIN_ATTR_RW(pio, 1);
    static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr,
    char *buf)
    {
    - if (put_user(w1_enable_crccheck + 0x30, buf))
    - return -EFAULT;
    -
    - return sizeof(w1_enable_crccheck);
    + return sysfs_emit(buf, "%d\n", w1_enable_crccheck);
    }

    static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr,
    const char *buf, size_t count)
    {
    - char val;
    -
    - if (count != 1 || !buf)
    - return -EINVAL;
    + int err = kstrtobool(buf, &w1_enable_crccheck);

    - if (get_user(val, buf))
    - return -EFAULT;
    + if (err)
    + return err;

    - /* convert to decimal */
    - val = val - 0x30;
    - if (val != 0 && val != 1)
    - return -EINVAL;
    -
    - /* set the new value */
    - w1_enable_crccheck = val;
    -
    - return sizeof(w1_enable_crccheck);
    + return count;
    }

    static DEVICE_ATTR_RW(crccheck);
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 01:11    [W:4.020 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site