Skip to contentSkip to conversation

iio: tsl2583: off by one in in_illuminance_lux_table_store()

PATCH In review Dan Carpenter 4 participants 8 messages Nov 18, 2016 – Nov 25, 2016

Subsystems (2)
Kernel janitors IIO
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 iio: tsl2583: off by one in in_illuminance_lux_table_store()

The value[] array has "max_ints" elements so this should be >= instead of >.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
drivers/iio/light/tsl2583.c +1 -1
index 0b87f6a..faef6bd 100644
@@ -580,7 +580,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	 * and the last table entry is all 0.
 	 */
 	n = value[0];
-	if ((n % 3) || n < 6 || n > max_ints) {
+	if ((n % 3) || n < 6 || n >= max_ints) {
 		dev_err(dev,
 			"%s: The number of entries in the lux table must be a multiple of 3 and within the range [6, %d]\n",
 			__func__, max_ints);
#1 lore raw
Quoted 11 lines · Dan Carpenter

The value[] array has "max_ints" elements so this should be >= instead of >.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
drivers/iio/light/tsl2583.c +0 -0
index 0b87f6a..faef6bd 100644

drivers/iio/light/tsl2583.c static ssize_t in_illuminance_lux_table_store(struct device *dev, · line 586

Quoted 8 lines
drivers/iio/light/tsl2583.c +1 -1
@@ -580,7 +580,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	 * and the last table entry is all 0.
 	 */
 	n = value[0];
-	if ((n % 3) || n < 6 || n > max_ints) {
+	if ((n % 3) || n < 6 || n >= max_ints) {
 		dev_err(dev,
 			"%s: The number of entries in the lux table must be a multiple of 3 and within the range [6, %d]\n",
 			__func__, max_ints);

Hi Dan,
Good catch! I believe that this should use a different fix though.
The definition of value in in_illuminance_lux_table_store() should be changed from:

int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];

to:

int value[(TSL2583_MAX_LUX_TABLE_ENTRIES * 3) + 1];

This will allow storing the extra integer from get_options() containing the integer count.

Otherwise, with your propsed change, someone would only be able to use 9 entries in the device lux table rather than the 10 that are set aside.

Also, this may be (well is) nit picking, but I had [6, 33] in the error message to mark the range as inclusive on both ends. If it was exclusive on the upper end, then the error message should have also been changed to be [6, 33).

Brian

author
#2 lore raw

PATCH 1/1 iio: tsl2583: make array large enough

This array is supposed to have 10 elements. Smatch complains that with the current code we can have n = max_ints and read beyond the end of the array.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
drivers/iio/light/tsl2583.c +1 -1
index 0b87f6a..a78b602 100644
@@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
 	struct tsl2583_chip *chip = iio_priv(indio_dev);
 	const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
-	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
+	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
 	int ret = -EINVAL;
 	unsigned int n;
Acked-by on v1 1/1
#3 lore raw

Re: [patch] iio: tsl2583: make array large enough

Quoted 12 lines · Dan Carpenter

This array is supposed to have 10 elements. Smatch complains that with the current code we can have n = max_ints and read beyond the end of the array.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
drivers/iio/light/tsl2583.c +0 -0
index 0b87f6a..a78b602 100644

drivers/iio/light/tsl2583.c static ssize_t in_illuminance_lux_table_store(struct device *dev, · line 571

Quoted 8 lines
drivers/iio/light/tsl2583.c +1 -1
@@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
 	struct tsl2583_chip *chip = iio_priv(indio_dev);
 	const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
-	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
+	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
 	int ret = -EINVAL;
 	unsigned int n;
Acked-by Brian Masney <[email protected]>
#4 lore raw

Re: [patch] iio: tsl2583: make array large enough

Am 24.11.2016 16:48, schrieb Brian Masney:

Quoted 8 lines · Dan Carpenter
Quoted 7 lines

This array is supposed to have 10 elements. Smatch complains that with the current code we can have n = max_ints and read beyond the end of the array.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
Quoted 14 lines

drivers/iio/light/tsl2583.c static ssize_t in_illuminance_lux_table_store(struct device *dev, · line 571

Quoted 13 lines
drivers/iio/light/tsl2583.c +1 -1
index 0b87f6a..a78b602 100644
@@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
 	struct tsl2583_chip *chip = iio_priv(indio_dev);
 	const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
-	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
+	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
 	int ret = -EINVAL;
 	unsigned int n;

sorry i did not notice that bevor ..
there is a
max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3

IMHO this should read either:
int value[max_ints+1];
or
max_ints=ARRAY_SIZE(value)-1;

(my personal favorite is dropping max_ints completely).

re,
wh

#5 lore raw

Re: [patch] iio: tsl2583: make array large enough

Quoted 26 lines · walter harms

Am 24.11.2016 16:48, schrieb Brian Masney:

Quoted 8 lines · Dan Carpenter
Quoted 7 lines

This array is supposed to have 10 elements. Smatch complains that with the current code we can have n = max_ints and read beyond the end of the array.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
Quoted 14 lines

drivers/iio/light/tsl2583.c static ssize_t in_illuminance_lux_table_store(struct device *dev, · line 571

Quoted 13 lines
drivers/iio/light/tsl2583.c +1 -1
index 0b87f6a..a78b602 100644
@@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
 	struct tsl2583_chip *chip = iio_priv(indio_dev);
 	const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
-	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
+	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
 	int ret = -EINVAL;
 	unsigned int n;
Quoted 6 lines

sorry i did not notice that bevor ..
there is a
max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3

IMHO this should read either:

   int value[max_ints+1];

I originally went this route when I refactored the function, however running make C=1 yields the following warnings:

drivers/iio/light/tsl2583.c:568:19: warning: Variable length array is used.
drivers/iio/light/tsl2583.c:574:26: error: cannot size expression

That is why I went with the current implementation.

Quoted 4 lines

or
max_ints=ARRAY_SIZE(value)-1;

(my personal favorite is dropping max_ints completely).

The max_ints value is also shown in the error message if the user passes in too many or too few entries in the per device lux table. I wanted the user to see the maximum allowable number without having to dig through the kernel source code. Without it, I would have had to duplicate the TSL2583_MAX_LUX_TABLE_ENTRIES * 3 statement a third time.

Brian

maintainer
#6 lore raw

Re: [patch] iio: tsl2583: make array large enough

Quoted 48 lines · Brian Masney
Quoted 26 lines · walter harms

Am 24.11.2016 16:48, schrieb Brian Masney:

Quoted 8 lines · Dan Carpenter
Quoted 7 lines

This array is supposed to have 10 elements. Smatch complains that with the current code we can have n = max_ints and read beyond the end of the array.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
Quoted 14 lines

drivers/iio/light/tsl2583.c static ssize_t in_illuminance_lux_table_store(struct device *dev, · line 571

Quoted 13 lines
drivers/iio/light/tsl2583.c +1 -1
index 0b87f6a..a78b602 100644
@@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
 	struct tsl2583_chip *chip = iio_priv(indio_dev);
 	const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
-	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
+	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
 	int ret = -EINVAL;
 	unsigned int n;
Quoted 6 lines

sorry i did not notice that bevor ..
there is a
max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3

IMHO this should read either:

   int value[max_ints+1];

I originally went this route when I refactored the function, however running make C=1 yields the following warnings:

drivers/iio/light/tsl2583.c:568:19: warning: Variable length array is used.
drivers/iio/light/tsl2583.c:574:26: error: cannot size expression

That is why I went with the current implementation.

Quoted 4 lines

or
max_ints=ARRAY_SIZE(value)-1;

(my personal favorite is dropping max_ints completely).

Quoted 8 lines

The max_ints value is also shown in the error message if the user passes in too many or too few entries in the per device lux table. I wanted the user to see the maximum allowable number without having to dig through the kernel source code. Without it, I would have had to duplicate the TSL2583_MAX_LUX_TABLE_ENTRIES * 3 statement a third time.

Brian

I'm taking this as is, because it'll just squeeze into my last pull request to Greg. Sorry for not waiting for this discussion to finish first!

Applied to the togreg branch of iio.git and pushed out as testing for the autobuilders to very briefly play with it.

Thanks,

Jonathan

#7 lore raw

Re: [patch] iio: tsl2583: make array large enough

In reply to Brian Masney

Am 24.11.2016 18:51, schrieb Brian Masney:

Quoted 48 lines · walter harms
Quoted 26 lines

Am 24.11.2016 16:48, schrieb Brian Masney:

Quoted 8 lines · Dan Carpenter
Quoted 7 lines

This array is supposed to have 10 elements. Smatch complains that with the current code we can have n = max_ints and read beyond the end of the array.

Fixes ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by Dan Carpenter <[email protected]>
Quoted 14 lines

drivers/iio/light/tsl2583.c static ssize_t in_illuminance_lux_table_store(struct device *dev, · line 571

Quoted 13 lines
drivers/iio/light/tsl2583.c +1 -1
index 0b87f6a..a78b602 100644
@@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
 	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
 	struct tsl2583_chip *chip = iio_priv(indio_dev);
 	const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
-	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
+	int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
 	int ret = -EINVAL;
 	unsigned int n;
Quoted 6 lines

sorry i did not notice that bevor ..
there is a
max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3

IMHO this should read either:

   int value[max_ints+1];

I originally went this route when I refactored the function, however running make C=1 yields the following warnings:

drivers/iio/light/tsl2583.c:568:19: warning: Variable length array is used.
drivers/iio/light/tsl2583.c:574:26: error: cannot size expression

That is why I went with the current implementation.

Quoted 4 lines

or
max_ints=ARRAY_SIZE(value)-1;

(my personal favorite is dropping max_ints completely).

Quoted 8 lines

The max_ints value is also shown in the error message if the user passes in too many or too few entries in the per device lux table. I wanted the user to see the maximum allowable number without having to dig through the kernel source code. Without it, I would have had to duplicate the TSL2583_MAX_LUX_TABLE_ENTRIES * 3 statement a third time.

Brian

Hello Brian, thanks for the replay,

i have no problem when people so such things intentional but some times people do this unintentional. When i review code, i see it as part of my job to challenge constructs where i get a strange feeling.

re,
wh