From patchwork Mon May 30 11:52:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cristian Marussi X-Patchwork-Id: 12864569 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8B589C433EF for ; Mon, 30 May 2022 11:54:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=912xr85cPPNQd+1qU6hwYR8OLf3+T7gjnlSTiJOmiJA=; b=r37zLhPGqZm6V7 dVL68QD8u2VFgjCHQAPpll0pwrF+MtH0XiGX9LQkbfP5BMY/8nAAhevSwEUZjadWpsqZzA6sD5+L4 rkL+WWzfPMQuMpTU5KUJ+j1qXlQhMtVfZ8fkDDD0JoQSz6JIKVxBW+Ttc3NltrJZ74ne/ZapptW+x RNofm/vakNY7jS/GwwhH+R4wH/BW4M5r72bDElZ0F4c91zc4IcLi6g4V61AF7sBwfVZlaIgmfQ6M6 k6dxXwsliAbNWF0lPs//xUfRYXZse71jzUJ044Asw+YgU3hNc0HVyldAGTX/FpqEuWbAIJJUHW/Ku rXn2yocuv/q5cpl57DOw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nvdxh-006Qbl-W2; Mon, 30 May 2022 11:53:30 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nvdxW-006QZ1-1S for linux-arm-kernel@lists.infradead.org; Mon, 30 May 2022 11:53:19 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id F1775153B; Mon, 30 May 2022 04:53:14 -0700 (PDT) Received: from e120937-lin.home (unknown [172.31.20.19]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 4E8363F766; Mon, 30 May 2022 04:53:14 -0700 (PDT) From: Cristian Marussi To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: Cristian Marussi , Sudeep Holla Subject: [PATCH 2/2] firmware: arm_scmi: Fix pointers arithmetic in Base protocol Date: Mon, 30 May 2022 12:52:37 +0100 Message-Id: <20220530115237.277077-2-cristian.marussi@arm.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220530115237.277077-1-cristian.marussi@arm.com> References: <20220530115237.277077-1-cristian.marussi@arm.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220530_045318_162271_E141935A X-CRM114-Status: GOOD ( 10.93 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Fix a possible undefined behaviour involving pointer arithmetic in Base protocol scmi_base_implementation_list_get(). cppcheck complains with: drivers/firmware/arm_scmi/base.c:190:19: warning: 't->rx.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [arithOperationsOnVoidPointer] list = t->rx.buf + sizeof(*num_ret); Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol") Cc: Sudeep Holla Signed-off-by: Cristian Marussi --- drivers/firmware/arm_scmi/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c index 20fba7370f4e..6d6214d9e68c 100644 --- a/drivers/firmware/arm_scmi/base.c +++ b/drivers/firmware/arm_scmi/base.c @@ -187,7 +187,7 @@ scmi_base_implementation_list_get(const struct scmi_protocol_handle *ph, num_skip = t->tx.buf; num_ret = t->rx.buf; - list = t->rx.buf + sizeof(*num_ret); + list = ((u8 *)t->rx.buf) + sizeof(*num_ret); do { size_t real_list_sz;