Hello PPC devs, Smatch has the following warning:
arch/powerpc/sysdev/fsl_rmu.c:884 fsl_open_inb_mbox() error: buffer overflow 'rmu->msg_tx_ring.virt_buffer' 2048 <= 2048 arch/powerpc/sysdev/fsl_rmu.c 861 for (i = 0; i < rmu->msg_rx_ring.size; i++) 862 rmu->msg_rx_ring.virt_buffer[i] = NULL; Here we set i one past the end of the ->virt_buffer[] array. 863 864 /* Initialize inbound message ring */ 865 rmu->msg_rx_ring.virt = dma_alloc_coherent(priv->dev, 866 rmu->msg_rx_ring.size * RIO_MAX_MSG_SIZE, 867 &rmu->msg_rx_ring.phys, GFP_KERNEL); 868 if (!rmu->msg_rx_ring.virt) { 869 rc = -ENOMEM; 870 goto out; 871 } 872 873 /* Point dequeue/enqueue pointers at first entry in ring */ 874 out_be32(&rmu->msg_regs->ifqdpar, (u32) rmu->msg_rx_ring.phys); 875 out_be32(&rmu->msg_regs->ifqepar, (u32) rmu->msg_rx_ring.phys); 876 877 /* Clear interrupt status */ 878 out_be32(&rmu->msg_regs->isr, 0x00000091); 879 880 /* Hook up inbound message handler */ 881 rc = request_irq(IRQ_RIO_RX(mport), fsl_rio_rx_handler, 0, 882 "msg_rx", (void *)mport); 883 if (rc < 0) { 884 dma_free_coherent(priv->dev, RIO_MSG_BUFFER_SIZE, 885 rmu->msg_tx_ring.virt_buffer[i], ^^^^^^^^^^^^^^ Wrong variable. 886 rmu->msg_tx_ring.phys_buffer[i]); ^^^^^^^^^^^^^^ This should probably be something like: dma_free_coherent(priv->dev, rmu->msg_rx_ring.size * RIO_MAX_MSG_SIZE, rmu->msg_rx_ring.virt, rmu->msg_rx_ring.phys); But dma_free_coherent() is poorly documented (it's not documented at all) and I can't even compile this code so I don't feel comfortable patching this myself. Please give me a Reported-by tag if you fix this. 887 goto out; 888 } regards, dan carpenter _______________________________________________ Linuxppc-dev mailing list Linuxppc-dev@lists.ozlabs.org https://lists.ozlabs.org/listinfo/linuxppc-dev