Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 73ed9127 authored by Christophe Leroy's avatar Christophe Leroy Committed by Greg Kroah-Hartman
Browse files

w1: Misuse of get_user()/put_user() reported by sparse 

[ Upstream commit 33dc3e3e99e626ce51f462d883b05856c6c30b1d ]

sparse warnings: (new ones prefixed by >>)
>> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@     expected char [noderef] __user *_pu_addr @@     got char *buf @@
   drivers/w1/slaves/w1_ds28e04.c:342:13: sparse:     expected char [noderef] __user *_pu_addr
   drivers/w1/slaves/w1_ds28e04.c:342:13: sparse:     got char *buf
>> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@     expected char const [noderef] __user *_gu_addr @@     got char const *buf @@
   drivers/w1/slaves/w1_ds28e04.c:356:13: sparse:     expected char const [noderef] __user *_gu_addr
   drivers/w1/slaves/w1_ds28e04.c:356:13: sparse:     got char const *buf

The buffer buf is a failsafe buffer in kernel space, it's not user
memory hence doesn't deserve the use of get_user() or put_user().

Access 'buf' content directly.

Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/


Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarChristophe Leroy <christophe.leroy@csgroup.eu>
Link: https://lore.kernel.org/r/d14ed8d71ad4372e6839ae427f91441d3ba0e94d.1637946316.git.christophe.leroy@csgroup.eu


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent b8e5376c

drivers/w1/slaves/w1_ds28e04.c

+6 −20
Original line number Diff line number Diff line
@@ -32,7 +32,7 @@ static int w1_strong_pullup = 1; 
module_param_named(strong_pullup, w1_strong_pullup, int, 0);



/* enable/disable CRC checking on DS28E04-100 memory accesses */

static char w1_enable_crccheck = 1;

static bool w1_enable_crccheck = true;



#define W1_EEPROM_SIZE		512

#define W1_PAGE_COUNT		16
@@ -339,32 +339,18 @@ static BIN_ATTR_RW(pio, 1); 
static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr,

			     char *buf)

{

	if (put_user(w1_enable_crccheck + 0x30, buf))

		return -EFAULT;



	return sizeof(w1_enable_crccheck);

	return sysfs_emit(buf, "%d\n", w1_enable_crccheck);

}



static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr,

			      const char *buf, size_t count)

{

	char val;



	if (count != 1 || !buf)

		return -EINVAL;

	int err = kstrtobool(buf, &w1_enable_crccheck);



	if (get_user(val, buf))

		return -EFAULT;

	if (err)

		return err;



	/* convert to decimal */

	val = val - 0x30;

	if (val != 0 && val != 1)

		return -EINVAL;



	/* set the new value */

	w1_enable_crccheck = val;



	return sizeof(w1_enable_crccheck);

	return count;

}



static DEVICE_ATTR_RW(crccheck);