Skip to contentSkip to conversation

Input: gamecon - use parallel port device model

DISCUSSION Dan Carpenter 2 participants 2 messages Oct 1, 2015 – Oct 2, 2015 HID

lore
Share & tools
lore
#0 lore raw

Hello Sudip Mukherjee,

The patch a517e87c3dfc: "Input: gamecon - use parallel port device model" from Sep 29, 2015, leads to the following static checker warning:

drivers/input/joystick/gamecon.c:988 gc_attach()
error: buffer overflow 'gc_base' 3 <= 5

drivers/input/joystick/gamecon.c
972

   973          for (i = 0; i < n_pads && i < GC_MAX_DEVICES; i++) {
                                              ^^^^^^^^^^^^^^

Should this be GC_MAX_PORTS?

974 if (!pads[i])
975 continue;
976
977 if (gc_setup_pad(gc, i, pads[i]))
978 goto err_unreg_devs;
979
980 count++;
981 }
982
983 if (count == 0) {
984 pr_err("No valid devices specified\n");
985 goto err_free_gc;
986 }
987

   988          gc_base[i] = gc;
                ^^^^^^^^^^

It's saying this is out of bounds.

Even if we change GC_MAX_DEVICES to GC_MAX_PORTS it will still complain because we are relying on n_pads to be less than GC_MAX_DEVICES. I guess we could change the other condition to be:

	if (count == 0 || i == GC_MAX_PORTS)
		goto err_free_gc;

989 return;
990

regards,
dan carpenter

#1 lore raw
Quoted 6 lines · Dan Carpenter

Hello Sudip Mukherjee,

The patch a517e87c3dfc: "Input: gamecon - use parallel port device model" from Sep 29, 2015, leads to the following static checker warning:

Quoted 7 lines

drivers/input/joystick/gamecon.c:988 gc_attach()
error: buffer overflow 'gc_base' 3 <= 5

drivers/input/joystick/gamecon.c
972

   973          for (i = 0; i < n_pads && i < GC_MAX_DEVICES; i++) {
                                              ^^^^^^^^^^^^^^

Thanks Dan. This would have been an ugly mess. I checked my othher patches and looks like they will also have the same mistake. I will send the patch to fix this rightaway.

Thanks again.

regards
sudip