diff options
| author | Jérôme Pouiller <jerome.pouiller@silabs.com> | 2020-10-09 19:13:04 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-10 12:33:59 +0200 |
| commit | 5f841fe69832c8440a5d940e4d768cf7b96f3b9f (patch) | |
| tree | e45784b157ace9e1057deecffd22a6291079678e /drivers/staging | |
| parent | b3c669be90ddfa70409ab6335dadf3ef46473f9a (diff) | |
staging: wfx: increase robustness of hif_generic_confirm()
Smatch complains:
drivers/staging/wfx/hif_rx.c:26 hif_generic_confirm() warn: negative user subtract: 0-u16max - 4
20 static int hif_generic_confirm(struct wfx_dev *wdev,
21 const struct hif_msg *hif, const void *buf)
22 {
23 // All confirm messages start with status
24 int status = le32_to_cpup((__le32 *)buf);
25 int cmd = hif->id;
26 int len = le16_to_cpu(hif->len) - 4; // drop header
^^^^^
27
28 WARN(!mutex_is_locked(&wdev->hif_cmd.lock), "data locking error");
In fact, rx_helper() already make the necessary checks on the value of
hif->len. Never mind, add an explicit check to make Smatch happy.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20201009171307.864608-6-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/wfx/hif_rx.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/wfx/hif_rx.c b/drivers/staging/wfx/hif_rx.c index ca09467cba05..2d4265257112 100644 --- a/drivers/staging/wfx/hif_rx.c +++ b/drivers/staging/wfx/hif_rx.c @@ -40,10 +40,10 @@ static int hif_generic_confirm(struct wfx_dev *wdev, } if (wdev->hif_cmd.buf_recv) { - if (wdev->hif_cmd.len_recv >= len) + if (wdev->hif_cmd.len_recv >= len && len > 0) memcpy(wdev->hif_cmd.buf_recv, buf, len); else - status = -ENOMEM; + status = -EIO; } wdev->hif_cmd.ret = status; |