On Sat, Sep 24, 2016 at 11:15 AM, Wolfram Sang <[email protected]> wrote:
>> drivers/gpio/gpio-pca953x.c | 2 ++
>> 1 file changed, 2 insertions(+)
>
> FYI, my code checkers found this in this driver:
>
> SMATCH
> drivers/gpio/gpio-pca953x.c:562 pca953x_irq_pending() error: buffer overflow
> 'cur_stat' 5 <= 8191
> drivers/gpio/gpio-pca953x.c:573 pca953x_irq_pending() warn: buffer overflow
> 'old_stat' 5 <= 8191
>
> Didn't check further. I fixed a sparse warning, though.
I guess those lines are
memcpy(old_stat, chip->irq_stat, NBANK(chip));
and
memcpy(chip->irq_stat, cur_stat, NBANK(chip));
?
#define NBANK(chip) DIV_ROUND_UP(chip->gpio_chip.ngpio, BANK_SZ)
ngpio is u16, BANK_SZ is 8, so smatch assumes someone may set
ngpio to 65535. Which someone could do through driver_data.
But none of the predefined entries in pca953x_dt_ids[] does.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
