]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
media: atomisp: fix 'read beyond size of field'
authorHans Verkuil <hverkuil-cisco@xs4all.nl>
Tue, 26 Sep 2023 09:27:09 +0000 (11:27 +0200)
committerHans Verkuil <hverkuil-cisco@xs4all.nl>
Wed, 27 Sep 2023 08:47:22 +0000 (10:47 +0200)
commit0301a15a42f2e414d6f628fb51821a186cbfbbbf
tree86a6152d2d5270a820b01407d7c637834bc31be8
parenta0bcd433b9bf8e256f7c0c4d8b91551dbd439fef
media: atomisp: fix 'read beyond size of field'

If CONFIG_FORTIFY_SOURCE=y, then this warning is produced:

In file included from ./include/linux/string.h:254,
                 from ./include/linux/bitmap.h:11,
                 from ./include/linux/cpumask.h:12,
                 from ./arch/x86/include/asm/cpumask.h:5,
                 from ./arch/x86/include/asm/msr.h:11,
                 from ./arch/x86/include/asm/processor.h:23,
                 from ./arch/x86/include/asm/cpufeature.h:5,
                 from ./arch/x86/include/asm/thread_info.h:53,
                 from ./include/linux/thread_info.h:60,
                 from ./arch/x86/include/asm/preempt.h:9,
                 from ./include/linux/preempt.h:79,
                 from ./include/linux/spinlock.h:56,
                 from ./include/linux/mmzone.h:8,
                 from ./include/linux/gfp.h:7,
                 from ./include/linux/slab.h:16,
                 from ./drivers/staging/media/atomisp//include/hmm/hmm.h:26,
                 from drivers/staging/media/atomisp/pci/sh_css_params.c:26:
In function ‘fortify_memcpy_chk’,
    inlined from ‘sh_css_store_sp_group_to_ddr’ at drivers/staging/media/atomisp/pci/sh_css_params.c:3736:3:
./include/linux/fortify-string.h:592:25: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()?
[-Wattribute-warning]
  592 |                         __read_overflow2_field(q_size_field, size);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The reason is that the memcpy copies two fields (each a u8), when the source
pointer points to the first field. It's a bit unexpected, so just make this
explicit.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
drivers/staging/media/atomisp/pci/sh_css_params.c