From: Josh Poimboeuf Date: Mon, 24 Mar 2025 21:56:08 +0000 (-0700) Subject: objtool, Input: cyapa - Remove undefined behavior in cyapa_update_fw_store() X-Git-Tag: v6.15-rc1~60^2~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7501153750b47416c9891038330359fad0205839;p=thirdparty%2Fkernel%2Fstable.git objtool, Input: cyapa - Remove undefined behavior in cyapa_update_fw_store() In cyapa_update_fw_store(), if 'count' is zero, the write to fw_name[count-1] underflows the array. Presumably that's not possible in normal operation, as its caller sysfs_kf_write() already checks for zero. Regardless it's a good idea to check for the error explicitly and avoid undefined behavior. Fixes the following warning with an UBSAN kernel: vmlinux.o: warning: objtool: .text.cyapa_update_fw_store: unexpected end of section Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Dmitry Torokhov Cc: Linus Torvalds Link: https://lore.kernel.org/r/73ae0bb3c656735890d914b74c9d6bb40c25d3cd.1742852847.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202503171547.LlCTJLQL-lkp@intel.com/ --- diff --git a/drivers/input/mouse/cyapa.c b/drivers/input/mouse/cyapa.c index 2f2d925a55d7a..00c87c0532a60 100644 --- a/drivers/input/mouse/cyapa.c +++ b/drivers/input/mouse/cyapa.c @@ -1080,8 +1080,8 @@ static ssize_t cyapa_update_fw_store(struct device *dev, char fw_name[NAME_MAX]; int ret, error; - if (count >= NAME_MAX) { - dev_err(dev, "File name too long\n"); + if (!count || count >= NAME_MAX) { + dev_err(dev, "Bad file name size\n"); return -EINVAL; }