From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7526D3D1CB3 for ; Wed, 25 Mar 2026 12:13:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774440831; cv=none; b=UBXknWwPKimQiIoqK3lUtj5pNHwiPtG3vdHJyqCfRdP13NHYVdZENhUbiyeNhLLr8ZvoOfRvLzCa77A+py/dRcCirmjSyYk0ZILO0f08/6JYFzivD238popzz7DS5DcoBdqSal+0OAtCvFv6vKriXkxNfbmjFcjH/xEQdP8yrHA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774440831; c=relaxed/simple; bh=Fb2dFEFBTzTYZiSW4NQ8boEo0Fa4e1j9QdAbr1VO+D4=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=aXETOsBBU8mNEeLn/41V5fy8/HIaCzgfkJ+zq58vD13DIuYHYLtnDt0ZyFtxRe2YOEXCqnEg/n5YfGKtMRLXBI2S1m0+tCPvmxo5ehIwbIjRCvo1UdsLdWTjzhE5ZpxoBLnwCiVyEpZ6dl68Jv9VoL86zhN/406YIfMsMxRL2yI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=zxG7/tvh; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="zxG7/tvh" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-48700b1ba53so46915005e9.1 for ; Wed, 25 Mar 2026 05:13:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1774440829; x=1775045629; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=h5E6moPRnekbmqdlOzYEpEz2bsLuOvHYrX+9kNxnP+U=; b=zxG7/tvhv/go7JFPM3TesmxZbJxhH33+8F7MiY1o/RqbrFmrrUWfrOwNflezgSdMrA Ngr9MTV64S+vGlNh36hNcF8prKWJBcZBZOGmzdTlYc+Luv7vh2ccqWo7U6DeCVeACC3m 7U+nETi7MFhsrWRf5kaBNhf8hLWEJ/RqjoYhEqoM1OZVokyZ8S19BSNmHhQFfSQ4T6T9 /oIBfAubWUiAmUS6INLT4GAuTpQbkyTlTM09RP/n/OMHXbY74tghZmDzEyhSsHD0QIAS 6oItpFm89Wbr6jTuqHrbS+Fu8gBipJXISw0UH5rrYHSNnosMRL+NT671AXCs3mwKHZc+ oZUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774440829; x=1775045629; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=h5E6moPRnekbmqdlOzYEpEz2bsLuOvHYrX+9kNxnP+U=; b=awIsXaUtXaY5M6nWdr5W2v72a+6umMWOQTf3lTnKx1tpuknhgOVsCenhWs3UF63I4q BpmfmbT96fq28PD/cPbcQ02TXKlmAGX3clKENA736SXCoCjMvgobzjOKGUOx7UzfzQc6 Bf5VrbnuIW6a/TfGP/IpbsgIBkNdj4xImcL0xIANQrzPYaef0GuSQhaQqsz/AiRtrJkc fFRcmoY6tKR+BZxfltw++2AohDmYCQh5PZMDO0jDJ8htXUJZiaR4H6BCO43Y7qam4mvA iEqwg6g7tIwR/duk36ZBGWUGo5lxs7GBnRC+qOydLhjq7gJ7gZX3TJkab4G0Kvqnn+dL 5rKw== X-Forwarded-Encrypted: i=1; AJvYcCWs76kFah2r8S7XvmWyteDIxKN5TnAGR9Jbw/MkL53Xf8RuKxNurydT205kANdr9WGeukEo6vBDP6v7l0g=@vger.kernel.org X-Gm-Message-State: AOJu0YwINRTtfjs82YpdDk1h/x3TXWWImfRVSpaYKLmOlyA1DbYJ1EQW AQyKBqKQx8NSWSdl8pOY7PJxyh/Stn8vtCR21KE0h2f+dEtpYvi6tQTzi2xBiyiy4/E= X-Gm-Gg: ATEYQzyaWNnPw8EOUC6D41MSgcAQ6WQs/BNG7fHjLKzl+gQvxmhlj2TXpIEoBTOX4/p Jhg/WViYcgXmFbdKsFU/vEj3SVx3iyVxLCY0qZK1ME8j8hhqSrGJdSI32V/9+PbXOJKdhUIp2sR Fy2m6egdeAgGN3aoeEgLa8wXr1acpeCJVznO9eqQfjy1xK27fWhXTeLxQpWOSHfucw4aaHFxuRq BO2bhZgi3Rakneq9ZDl537K1pIERJ03HJ7uRKQFwn/VvNA9eF6IQ64UeR0sINb6mCtf/xpxx1fT vRQ8/efOBBqlF5H12qk29Cj6O+A6B9F9PmRY7DX6rBwSg5LpQXLW6ljmIWDcH+Z4iAmfEUD3qdy knepYzt8vuBo49ekIYNiNPBIkoDuNHydPeczXcNyr2N20o2sZKPFCR1Pm7roj61gvwhCal8yWcy D/5GXYRTL23hIgoPep0Q1zePjnmvAK X-Received: by 2002:a05:600c:45c4:b0:485:3c8f:e4d9 with SMTP id 5b1f17b1804b1-48716067413mr46067455e9.26.1774440828759; Wed, 25 Mar 2026 05:13:48 -0700 (PDT) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43b64714e2esm49760795f8f.32.2026.03.25.05.13.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Mar 2026 05:13:47 -0700 (PDT) Date: Wed, 25 Mar 2026 15:13:44 +0300 From: Dan Carpenter To: oe-kbuild@lists.linux.dev, Michal Wilczynski Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org, Ulf Hansson , Kees Cook Subject: drivers/firmware/thead,th1520-aon.c:174 th1520_aon_power_update() error: buffer overflow 'data' 2 <= 3 Message-ID: <202603251917.9rxYz4kf-lkp@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: bbeb83d3182abe0d245318e274e8531e5dd7a948 commit: e4b3cbd840e565484d0ad8d260d27c057466ed17 firmware: thead: Add AON firmware protocol driver config: riscv-randconfig-r073-20260325 (https://download.01.org/0day-ci/archive/20260325/202603251917.9rxYz4kf-lkp@intel.com/config) compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 054e11d1a17e5ba88bb1a8ef32fad3346e80b186) rustc: rustc 1.88.0 (6b00bc388 2025-06-23) smatch: v0.5.0-9004-gb810ac53 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot | Reported-by: Dan Carpenter | Closes: https://lore.kernel.org/r/202603251917.9rxYz4kf-lkp@intel.com/ New smatch warnings: drivers/firmware/thead,th1520-aon.c:174 th1520_aon_power_update() error: buffer overflow 'data' 2 <= 3 vim +/data +174 drivers/firmware/thead,th1520-aon.c e4b3cbd840e5654 Michal Wilczynski 2025-03-11 162 int th1520_aon_power_update(struct th1520_aon_chan *aon_chan, u16 rsrc, e4b3cbd840e5654 Michal Wilczynski 2025-03-11 163 bool power_on) e4b3cbd840e5654 Michal Wilczynski 2025-03-11 164 { e4b3cbd840e5654 Michal Wilczynski 2025-03-11 165 struct th1520_aon_msg_req_set_resource_power_mode msg = {}; e4b3cbd840e5654 Michal Wilczynski 2025-03-11 166 struct th1520_aon_rpc_msg_hdr *hdr = &msg.hdr; e4b3cbd840e5654 Michal Wilczynski 2025-03-11 167 int ret; e4b3cbd840e5654 Michal Wilczynski 2025-03-11 168 e4b3cbd840e5654 Michal Wilczynski 2025-03-11 169 hdr->svc = TH1520_AON_RPC_SVC_PM; e4b3cbd840e5654 Michal Wilczynski 2025-03-11 170 hdr->func = TH1520_AON_PM_FUNC_SET_RESOURCE_POWER_MODE; e4b3cbd840e5654 Michal Wilczynski 2025-03-11 171 hdr->size = TH1520_AON_RPC_MSG_NUM; e4b3cbd840e5654 Michal Wilczynski 2025-03-11 172 e4b3cbd840e5654 Michal Wilczynski 2025-03-11 173 RPC_SET_BE16(&msg.resource, 0, rsrc); e4b3cbd840e5654 Michal Wilczynski 2025-03-11 @174 RPC_SET_BE16(&msg.resource, 2, e4b3cbd840e5654 Michal Wilczynski 2025-03-11 175 (power_on ? TH1520_AON_PM_PW_MODE_ON : e4b3cbd840e5654 Michal Wilczynski 2025-03-11 176 TH1520_AON_PM_PW_MODE_OFF)); This is deliberate, but I'm surprised the runtime hardening we have done doesn't complain that we're writing outside the &msg.resource struct member... Maybe the RPC_SET_BE16() macro adds enough indirection to confuse the checker. Why not just do?: msg.mode = cpu_to_be16(power_on ? TH1520_AON_PM_PW_MODE_ON : TH1520_AON_PM_PW_MODE_OFF); e4b3cbd840e5654 Michal Wilczynski 2025-03-11 177 e4b3cbd840e5654 Michal Wilczynski 2025-03-11 178 ret = th1520_aon_call_rpc(aon_chan, &msg); e4b3cbd840e5654 Michal Wilczynski 2025-03-11 179 if (ret) e4b3cbd840e5654 Michal Wilczynski 2025-03-11 180 dev_err(aon_chan->cl.dev, "failed to power %s resource %d ret %d\n", e4b3cbd840e5654 Michal Wilczynski 2025-03-11 181 power_on ? "up" : "off", rsrc, ret); e4b3cbd840e5654 Michal Wilczynski 2025-03-11 182 e4b3cbd840e5654 Michal Wilczynski 2025-03-11 183 return ret; e4b3cbd840e5654 Michal Wilczynski 2025-03-11 184 } -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki