linux-kernel - [atishp04:sbi_pmu_v6 14/17] drivers/perf/riscv_pmu_sbi.c:464 pmu_sbi_get_ctrinfo() warn: potentially one past the end of array 'pmu_ctr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 24 Feb 2022 13:31:41 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Atish Patra <atish.patra@....com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        Atish Patra <Atish.Patra@....com>, linux-kernel@...r.kernel.org
Subject: [atishp04:sbi_pmu_v6 14/17] drivers/perf/riscv_pmu_sbi.c:464
 pmu_sbi_get_ctrinfo() warn: potentially one past the end of array
 'pmu_ctr_list[i]'

tree:   https://github.com/atishp04/linux sbi_pmu_v6
head:   876094386d4f915d81ec2ee5b8b412987a10d808
commit: 626af3184b715c86adace38af397cf4223f2cb75 [14/17] RISC-V: Add perf platform driver based on SBI PMU extension
config: riscv-randconfig-m031-20220222 (https://download.01.org/0day-ci/archive/20220223/202202230110.onIE1TGT-lkp@intel.com/config)
compiler: riscv64-linux-gcc (GCC) 11.2.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/perf/riscv_pmu_sbi.c:464 pmu_sbi_get_ctrinfo() warn: potentially one past the end of array 'pmu_ctr_list[i]'
drivers/perf/riscv_pmu_sbi.c:464 pmu_sbi_get_ctrinfo() warn: potentially one past the end of array 'pmu_ctr_list[i]'

vim +464 drivers/perf/riscv_pmu_sbi.c

626af3184b715c Atish Patra 2021-03-17  444  static int pmu_sbi_get_ctrinfo(int nctr)
626af3184b715c Atish Patra 2021-03-17  445  {
626af3184b715c Atish Patra 2021-03-17  446  	struct sbiret ret;
626af3184b715c Atish Patra 2021-03-17  447  	int i, num_hw_ctr = 0, num_fw_ctr = 0;
626af3184b715c Atish Patra 2021-03-17  448  	union sbi_pmu_ctr_info cinfo;
626af3184b715c Atish Patra 2021-03-17  449  
626af3184b715c Atish Patra 2021-03-17  450  	pmu_ctr_list = kcalloc(nctr, sizeof(*pmu_ctr_list), GFP_KERNEL);
                                                ^^^^^^^^^^^^           ^^^^

626af3184b715c Atish Patra 2021-03-17  451  	if (!pmu_ctr_list)
626af3184b715c Atish Patra 2021-03-17  452  		return -ENOMEM;
626af3184b715c Atish Patra 2021-03-17  453  
626af3184b715c Atish Patra 2021-03-17  454  	for (i = 0; i <= nctr; i++) {

This should be < nctr instead of <= nctr.

626af3184b715c Atish Patra 2021-03-17  455  		ret = sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_GET_INFO, i, 0, 0, 0, 0, 0);
626af3184b715c Atish Patra 2021-03-17  456  		if (ret.error)
626af3184b715c Atish Patra 2021-03-17  457  			/* The logical counter ids are not expected to be contiguous */
626af3184b715c Atish Patra 2021-03-17  458  			continue;
626af3184b715c Atish Patra 2021-03-17  459  		cinfo.value = ret.value;
626af3184b715c Atish Patra 2021-03-17  460  		if (cinfo.type == SBI_PMU_CTR_TYPE_FW)
626af3184b715c Atish Patra 2021-03-17  461  			num_fw_ctr++;
626af3184b715c Atish Patra 2021-03-17  462  		else
626af3184b715c Atish Patra 2021-03-17  463  			num_hw_ctr++;
626af3184b715c Atish Patra 2021-03-17 @464  		pmu_ctr_list[i].value = cinfo.value;
                                                        ^^^^^^^^^^^^^^^^

off by one

626af3184b715c Atish Patra 2021-03-17  465  	}
626af3184b715c Atish Patra 2021-03-17  466  
626af3184b715c Atish Patra 2021-03-17  467  	pr_info("%d firmware and %d hardware counters\n", num_fw_ctr, num_hw_ctr);
626af3184b715c Atish Patra 2021-03-17  468  
626af3184b715c Atish Patra 2021-03-17  469  	return 0;
626af3184b715c Atish Patra 2021-03-17  470  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org