False positive because the last irteration through the loop always
breaks.
This functions seems to have a lot of user trigerable pr_err() calls
though, so that sucks.
regards,
dan carpenter
On Mon, Dec 09, 2013 at 09:50:39PM +0800, Fengguang Wu wrote:
> TO: Tom Lendacky <thomas.lenda...@amd.com>
> CC: Herbert Xu <herb...@gondor.apana.org.au>
>
>
> Hi Tom,
>
> FYI, there are new smatch warnings show up in
>
> tree:
> git://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
> head: e37b94ebffdd93d121e5308eb93e2e55a0893fbb
> commit: f114766088f352a47f57307ff927b815e0239644 [16/25] crytpo: ccp - CCP
> device driver build files
> :::::: branch date: 2 hours ago
> :::::: commit date: 4 days ago
>
> drivers/crypto/ccp/ccp-crypto-aes-xts.c:147 ccp_aes_xts_crypt() error: buffer
> overflow 'unit_size_map' 10 <= 10
> drivers/crypto/ccp/ccp-crypto-aes-xts.c:168 ccp_aes_xts_crypt() error: buffer
> overflow 'unit_size_map' 10 <= 10
>
> git remote add cryptodev
> git://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
> git remote update cryptodev
> git checkout f114766088f352a47f57307ff927b815e0239644
> vim +/unit_size_map +147 drivers/crypto/ccp/ccp-crypto-aes-xts.c
>
> 1d6b8a6f Tom Lendacky 2013-11-12 141 }
> 1d6b8a6f Tom Lendacky 2013-11-12 142
> 1d6b8a6f Tom Lendacky 2013-11-12 143 for (unit = 0; unit <
> ARRAY_SIZE(unit_size_map); unit++)
> 1d6b8a6f Tom Lendacky 2013-11-12 144 if (!(req->nbytes &
> (unit_size_map[unit].size - 1)))
> 1d6b8a6f Tom Lendacky 2013-11-12 145 break;
> 1d6b8a6f Tom Lendacky 2013-11-12 146
> 1d6b8a6f Tom Lendacky 2013-11-12 @147 if ((unit_size_map[unit].value
> == CCP_XTS_AES_UNIT_SIZE__LAST) ||
> 1d6b8a6f Tom Lendacky 2013-11-12 148 (ctx->u.aes.key_len !=
> AES_KEYSIZE_128)) {
> 1d6b8a6f Tom Lendacky 2013-11-12 149 /* Use the fallback to
> process the request for any
> 1d6b8a6f Tom Lendacky 2013-11-12 150 * unsupported unit
> sizes or key sizes
> 1d6b8a6f Tom Lendacky 2013-11-12 151 */
> 1d6b8a6f Tom Lendacky 2013-11-12 152
> ablkcipher_request_set_tfm(req, ctx->u.aes.tfm_ablkcipher);
> 1d6b8a6f Tom Lendacky 2013-11-12 153 ret = (encrypt) ?
> crypto_ablkcipher_encrypt(req) :
> 1d6b8a6f Tom Lendacky 2013-11-12 154
> crypto_ablkcipher_decrypt(req);
> 1d6b8a6f Tom Lendacky 2013-11-12 155
> ablkcipher_request_set_tfm(req, __crypto_ablkcipher_cast(tfm));
> 1d6b8a6f Tom Lendacky 2013-11-12 156
> 1d6b8a6f Tom Lendacky 2013-11-12 157 return ret;
> 1d6b8a6f Tom Lendacky 2013-11-12 158 }
> 1d6b8a6f Tom Lendacky 2013-11-12 159
> 1d6b8a6f Tom Lendacky 2013-11-12 160 memcpy(rctx->iv, req->info,
> AES_BLOCK_SIZE);
> 1d6b8a6f Tom Lendacky 2013-11-12 161 sg_init_one(&rctx->iv_sg,
> rctx->iv, AES_BLOCK_SIZE);
> 1d6b8a6f Tom Lendacky 2013-11-12 162
> 1d6b8a6f Tom Lendacky 2013-11-12 163 memset(&rctx->cmd, 0,
> sizeof(rctx->cmd));
> 1d6b8a6f Tom Lendacky 2013-11-12 164
> INIT_LIST_HEAD(&rctx->cmd.entry);
> 1d6b8a6f Tom Lendacky 2013-11-12 165 rctx->cmd.engine =
> CCP_ENGINE_XTS_AES_128;
> 1d6b8a6f Tom Lendacky 2013-11-12 166 rctx->cmd.u.xts.action =
> (encrypt) ? CCP_AES_ACTION_ENCRYPT
> 1d6b8a6f Tom Lendacky 2013-11-12 167
> : CCP_AES_ACTION_DECRYPT;
> 1d6b8a6f Tom Lendacky 2013-11-12 @168 rctx->cmd.u.xts.unit_size =
> unit_size_map[unit].value;
> 1d6b8a6f Tom Lendacky 2013-11-12 169 rctx->cmd.u.xts.key =
> &ctx->u.aes.key_sg;
> 1d6b8a6f Tom Lendacky 2013-11-12 170 rctx->cmd.u.xts.key_len =
> ctx->u.aes.key_len;
> 1d6b8a6f Tom Lendacky 2013-11-12 171 rctx->cmd.u.xts.iv =
> &rctx->iv_sg;
>
> :::::: The code at line 147 was first introduced by commit
> :::::: 1d6b8a6f64076aee9e63474c0778a50f95c054ee crypto: ccp - CCP XTS-AES
> crypto API support
>
> :::::: TO: Tom Lendacky <thomas.lenda...@amd.com>
> :::::: CC: Herbert Xu <herb...@gondor.apana.org.au>
>
> ---
> 0-DAY kernel build testing backend Open Source Technology Center
> http://lists.01.org/mailman/listinfo/kbuild Intel Corporation
_______________________________________________
kbuild mailing list
kbuild@lists.01.org
https://lists.01.org/mailman/listinfo/kbuild
