tree:
https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git queue-5.4
head: 77a44bba1ea4d66d12ed435d12a22adbff1293dc
commit: b002578e8727ebdcca98e31ebe1a56551e60eab7 [11/21] libnvdimm: Validate command
family indices
config: x86_64-randconfig-s022-20200823 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
reproduce:
# apt-get install sparse
# sparse version: v0.6.2-191-g10164920-dirty
git checkout b002578e8727ebdcca98e31ebe1a56551e60eab7
# save the attached .config to linux build tree
make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' ARCH=x86_64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All errors (new ones prefixed by >>):
drivers/nvdimm/bus.c: In function '__nd_ioctl':
> drivers/nvdimm/bus.c:1016:24: error: 'NVDIMM_FAMILY_MAX'
undeclared (first use in this function); did you mean 'NVDIMM_FAMILY_MSFT'?
1016 | if (pkg.nd_family > NVDIMM_FAMILY_MAX)
| ^~~~~~~~~~~~~~~~~
| NVDIMM_FAMILY_MSFT
drivers/nvdimm/bus.c:1016:24: note: each undeclared identifier is reported only once
for each function it appears in
> drivers/nvdimm/bus.c:1020:24: error:
'NVDIMM_BUS_FAMILY_MAX' undeclared (first use in this function); did you mean
'NVDIMM_FAMILY_MSFT'?
1020 | if (pkg.nd_family >
NVDIMM_BUS_FAMILY_MAX)
| ^~~~~~~~~~~~~~~~~~~~~
| NVDIMM_FAMILY_MSFT
#
https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git/c...
git remote add sashal-linux-stable
https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git
git fetch --no-tags sashal-linux-stable queue-5.4
git checkout b002578e8727ebdcca98e31ebe1a56551e60eab7
vim +1016 drivers/nvdimm/bus.c
977
978 static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
979 int read_only, unsigned int ioctl_cmd, unsigned long arg)
980 {
981 struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
982 const struct nd_cmd_desc *desc = NULL;
983 unsigned int cmd = _IOC_NR(ioctl_cmd);
984 struct device *dev = &nvdimm_bus->dev;
985 void __user *p = (void __user *) arg;
986 char *out_env = NULL, *in_env = NULL;
987 const char *cmd_name, *dimm_name;
988 u32 in_len = 0, out_len = 0;
989 unsigned int func = cmd;
990 unsigned long cmd_mask;
991 struct nd_cmd_pkg pkg;
992 int rc, i, cmd_rc;
993 void *buf = NULL;
994 u64 buf_len = 0;
995
996 if (nvdimm) {
997 desc = nd_cmd_dimm_desc(cmd);
998 cmd_name = nvdimm_cmd_name(cmd);
999 cmd_mask = nvdimm->cmd_mask;
1000 dimm_name = dev_name(&nvdimm->dev);
1001 } else {
1002 desc = nd_cmd_bus_desc(cmd);
1003 cmd_name = nvdimm_bus_cmd_name(cmd);
1004 cmd_mask = nd_desc->cmd_mask;
1005 dimm_name = "bus";
1006 }
1007
1008 /* Validate command family support against bus declared support */
1009 if (cmd == ND_CMD_CALL) {
1010 unsigned long *mask;
1011
1012 if (copy_from_user(&pkg, p, sizeof(pkg)))
1013 return -EFAULT;
1014
1015 if (nvdimm) {
1016 if (pkg.nd_family > NVDIMM_FAMILY_MAX)
1017 return -EINVAL;
1018 mask = &nd_desc->dimm_family_mask;
1019 } else {
1020 if (pkg.nd_family > NVDIMM_BUS_FAMILY_MAX)
1021 return -EINVAL;
1022 mask = &nd_desc->bus_family_mask;
1023 }
1024
1025 if (!test_bit(pkg.nd_family, mask))
1026 return -EINVAL;
1027 }
1028
1029 if (!desc ||
1030 (desc->out_num + desc->in_num == 0) ||
1031 cmd > ND_CMD_CALL ||
1032 !test_bit(cmd, &cmd_mask))
1033 return -ENOTTY;
1034
1035 /* fail write commands (when read-only) */
1036 if (read_only)
1037 switch (cmd) {
1038 case ND_CMD_VENDOR:
1039 case ND_CMD_SET_CONFIG_DATA:
1040 case ND_CMD_ARS_START:
1041 case ND_CMD_CLEAR_ERROR:
1042 case ND_CMD_CALL:
1043 dev_dbg(dev, "'%s' command while read-only.\n",
1044 nvdimm ? nvdimm_cmd_name(cmd)
1045 : nvdimm_bus_cmd_name(cmd));
1046 return -EPERM;
1047 default:
1048 break;
1049 }
1050
1051 /* process an input envelope */
1052 in_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
1053 if (!in_env)
1054 return -ENOMEM;
1055 for (i = 0; i < desc->in_num; i++) {
1056 u32 in_size, copy;
1057
1058 in_size = nd_cmd_in_size(nvdimm, cmd, desc, i, in_env);
1059 if (in_size == UINT_MAX) {
1060 dev_err(dev, "%s:%s unknown input size cmd: %s field: %d\n",
1061 __func__, dimm_name, cmd_name, i);
1062 rc = -ENXIO;
1063 goto out;
1064 }
1065 if (in_len < ND_CMD_MAX_ENVELOPE)
1066 copy = min_t(u32, ND_CMD_MAX_ENVELOPE - in_len, in_size);
1067 else
1068 copy = 0;
1069 if (copy && copy_from_user(&in_env[in_len], p + in_len, copy)) {
1070 rc = -EFAULT;
1071 goto out;
1072 }
1073 in_len += in_size;
1074 }
1075
1076 if (cmd == ND_CMD_CALL) {
1077 func = pkg.nd_command;
1078 dev_dbg(dev, "%s, idx: %llu, in: %u, out: %u, len %llu\n",
1079 dimm_name, pkg.nd_command,
1080 in_len, out_len, buf_len);
1081 }
1082
1083 /* process an output envelope */
1084 out_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
1085 if (!out_env) {
1086 rc = -ENOMEM;
1087 goto out;
1088 }
1089
1090 for (i = 0; i < desc->out_num; i++) {
1091 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
1092 (u32 *) in_env, (u32 *) out_env, 0);
1093 u32 copy;
1094
1095 if (out_size == UINT_MAX) {
1096 dev_dbg(dev, "%s unknown output size cmd: %s field: %d\n",
1097 dimm_name, cmd_name, i);
1098 rc = -EFAULT;
1099 goto out;
1100 }
1101 if (out_len < ND_CMD_MAX_ENVELOPE)
1102 copy = min_t(u32, ND_CMD_MAX_ENVELOPE - out_len, out_size);
1103 else
1104 copy = 0;
1105 if (copy && copy_from_user(&out_env[out_len],
1106 p + in_len + out_len, copy)) {
1107 rc = -EFAULT;
1108 goto out;
1109 }
1110 out_len += out_size;
1111 }
1112
1113 buf_len = (u64) out_len + (u64) in_len;
1114 if (buf_len > ND_IOCTL_MAX_BUFLEN) {
1115 dev_dbg(dev, "%s cmd: %s buf_len: %llu > %d\n", dimm_name,
1116 cmd_name, buf_len, ND_IOCTL_MAX_BUFLEN);
1117 rc = -EINVAL;
1118 goto out;
1119 }
1120
1121 buf = vmalloc(buf_len);
1122 if (!buf) {
1123 rc = -ENOMEM;
1124 goto out;
1125 }
1126
1127 if (copy_from_user(buf, p, buf_len)) {
1128 rc = -EFAULT;
1129 goto out;
1130 }
1131
1132 nd_device_lock(dev);
1133 nvdimm_bus_lock(dev);
1134 rc = nd_cmd_clear_to_send(nvdimm_bus, nvdimm, func, buf);
1135 if (rc)
1136 goto out_unlock;
1137
1138 rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, &cmd_rc);
1139 if (rc < 0)
1140 goto out_unlock;
1141
1142 if (!nvdimm && cmd == ND_CMD_CLEAR_ERROR && cmd_rc >= 0) {
1143 struct nd_cmd_clear_error *clear_err = buf;
1144
1145 nvdimm_account_cleared_poison(nvdimm_bus, clear_err->address,
1146 clear_err->cleared);
1147 }
1148
1149 if (copy_to_user(p, buf, buf_len))
1150 rc = -EFAULT;
1151
1152 out_unlock:
1153 nvdimm_bus_unlock(dev);
1154 nd_device_unlock(dev);
1155 out:
1156 kfree(in_env);
1157 kfree(out_env);
1158 vfree(buf);
1159 return rc;
1160 }
1161
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org