• Kees Cook's avatar
    net: chelsio: cxgb4: Avoid potential negative array offset · 1c7ab9cd
    Kees Cook authored
    Using min_t(int, ...) as a potential array index implies to the compiler
    that negative offsets should be allowed. This is not the case, though.
    Replace "int" with "unsigned int". Fixes the following warning exposed
    under future CONFIG_FORTIFY_SOURCE improvements:
    
    In file included from include/linux/string.h:253,
                     from include/linux/bitmap.h:11,
                     from include/linux/cpumask.h:12,
                     from include/linux/smp.h:13,
                     from include/linux/lockdep.h:14,
                     from include/linux/rcupdate.h:29,
                     from include/linux/rculist.h:11,
                     from include/linux/pid.h:5,
                     from include/linux/sched.h:14,
                     from include/linux/delay.h:23,
                     from drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:35:
    drivers/net/ethernet/chelsio/cxgb4/t4_hw.c: In function 't4_get_raw_vpd_params':
    include/linux/fortify-string.h:46:33: warning: '__builtin_memcpy' pointer overflow between offset 29 and size [2147483648, 4294967295] [-Warray-bounds]
       46 | #define __underlying_memcpy     __builtin_memcpy
          |                                 ^
    include/linux/fortify-string.h:388:9: note: in expansion of macro '__underlying_memcpy'
      388 |         __underlying_##op(p, q, __fortify_size);                        \
          |         ^~~~~~~~~~~~~
    include/linux/fortify-string.h:433:26: note: in expansion of macro '__fortify_memcpy_chk'
      433 | #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,                  \
          |                          ^~~~~~~~~~~~~~~~~~~~
    drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2796:9: note: in expansion of macro 'memcpy'
     2796 |         memcpy(p->id, vpd + id, min_t(int, id_len, ID_LEN));
          |         ^~~~~~
    include/linux/fortify-string.h:46:33: warning: '__builtin_memcpy' pointer overflow between offset 0 and size [2147483648, 4294967295] [-Warray-bounds]
       46 | #define __underlying_memcpy     __builtin_memcpy
          |                                 ^
    include/linux/fortify-string.h:388:9: note: in expansion of macro '__underlying_memcpy'
      388 |         __underlying_##op(p, q, __fortify_size);                        \
          |         ^~~~~~~~~~~~~
    include/linux/fortify-string.h:433:26: note: in expansion of macro '__fortify_memcpy_chk'
      433 | #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,                  \
          |                          ^~~~~~~~~~~~~~~~~~~~
    drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2798:9: note: in expansion of macro 'memcpy'
     2798 |         memcpy(p->sn, vpd + sn, min_t(int, sn_len, SERNUM_LEN));
          |         ^~~~~~
    
    Additionally remove needless cast from u8[] to char * in last strim()
    call.
    Reported-by: default avatarkernel test robot <lkp@intel.com>
    Link: https://lore.kernel.org/lkml/202205031926.FVP7epJM-lkp@intel.com
    Fixes: fc927929 ("cxgb4: Search VPD with pci_vpd_find_ro_info_keyword()")
    Fixes: 24c521f8 ("cxgb4: Use pci_vpd_find_id_string() to find VPD ID string")
    Cc: Raju Rangoju <rajur@chelsio.com>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20220505233101.1224230-1-keescook@chromium.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    1c7ab9cd
t4_hw.c 307 KB