linux-kernel - [bug report] drm/imagination: Add gpuid module parameter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYXvElClUKW_DY_I@stanley.mountain>
Date: Fri, 6 Feb 2026 16:39:30 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Alexandru Dadu <alexandru.dadu@...tec.com>
Cc: dri-devel@...ts.freedesktop.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: [bug report] drm/imagination: Add gpuid module parameter

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Alexandru Dadu,

Commit 3bf74137340a ("drm/imagination: Add gpuid module parameter")
from Jan 13, 2026 (linux-next), leads to the following Smatch static
checker warning:

	drivers/gpu/drm/imagination/pvr_device.c:485 pvr_gpuid_decode_string()
	warn: error code type promoted to positive: 'ret'

drivers/gpu/drm/imagination/pvr_device.c
    475         int ret, idx = 0;
    476         u16 user_bvnc_u16[4];
    477         u8 dot_cnt = 0;
    478 
    479         ret = strscpy(str_cpy, param_bvnc);
    480 
    481         /*
    482          * strscpy() should return at least a size 7 for the input to be valid.
    483          * Returns -E2BIG for the case when the string is empty or too long.
    484          */
--> 485         if (ret < PVR_GPUID_STRING_MIN_LENGTH) {

PVR_GPUID_STRING_MIN_LENGTH is unsigned so -E2BIG is type promoted to
positive and treated as success.

    486                 drm_info(drm_dev,
    487                          "Invalid size of the input GPU ID (BVNC): %s",
    488                          str_cpy);
    489                 return -EINVAL;
    490         }
    491 
    492         while (*param_bvnc) {
    493                 if (*param_bvnc == '.')
    494                         dot_cnt++;
    495                 param_bvnc++;
    496         }

regards,
dan carpenter