GCC versions below 13 incorrectly detect the copy size as being static and too
small to fit in the "fds" array. Work around this by explicitly calculating the
size and returning EINVAL based on that, instead of based on the object count.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202502072019.LYoCR9bF-lkp@intel.com/
Suggested-by: Arnd Bergmann <arnd@arndb.de>

--

Suggested-by as per Arnd's request, but the only thing I changed was preserving
array_size() [as noted by Geert in the linked thread]. I tested and found no
regressions.

---
 drivers/misc/ntsync.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/ntsync.c b/drivers/misc/ntsync.c
index 586b86243e1d..24cb2f71186a 100644
--- a/drivers/misc/ntsync.c
+++ b/drivers/misc/ntsync.c
@@ -873,6 +873,7 @@ static int setup_wait(struct ntsync_device *dev,
 {
 	int fds[NTSYNC_MAX_WAIT_COUNT + 1];
 	const __u32 count = args->count;
+	size_t size = array_size(count, sizeof(fds[0]));
 	struct ntsync_q *q;
 	__u32 total_count;
 	__u32 i, j;
@@ -880,15 +881,14 @@ static int setup_wait(struct ntsync_device *dev,
 	if (args->pad || (args->flags & ~NTSYNC_WAIT_REALTIME))
 		return -EINVAL;
 
-	if (args->count > NTSYNC_MAX_WAIT_COUNT)
+	if (size >= sizeof(fds))
 		return -EINVAL;
 
 	total_count = count;
 	if (args->alert)
 		total_count++;
 
-	if (copy_from_user(fds, u64_to_user_ptr(args->objs),
-			   array_size(count, sizeof(*fds))))
+	if (copy_from_user(fds, u64_to_user_ptr(args->objs), size))
 		return -EFAULT;
 	if (args->alert)
 		fds[count] = args->alert;
-- 
2.47.2

On Tue, Feb 18, 2025 at 06:19:20PM -0600, Elizabeth Figura wrote:
> GCC versions below 13 incorrectly detect the copy size as being static and too
> small to fit in the "fds" array. Work around this by explicitly calculating the
> size and returning EINVAL based on that, instead of based on the object count.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202502072019.LYoCR9bF-lkp@intel.com/
> Suggested-by: Arnd Bergmann <arnd@arndb.de>
> 
> --
> 
> Suggested-by as per Arnd's request, but the only thing I changed was preserving
> array_size() [as noted by Geert in the linked thread]. I tested and found no
> regressions.

You forgot to sign-off on this commit :(

Can you resend it please with that fixed?

thanks,

greg k-h

On Wednesday, 19 February 2025 08:25:27 CST Greg Kroah-Hartman wrote:
> On Tue, Feb 18, 2025 at 06:19:20PM -0600, Elizabeth Figura wrote:
> > GCC versions below 13 incorrectly detect the copy size as being static and too
> > small to fit in the "fds" array. Work around this by explicitly calculating the
> > size and returning EINVAL based on that, instead of based on the object count.
> > 
> > Reported-by: kernel test robot <lkp@intel.com>
> > Closes: https://lore.kernel.org/oe-kbuild-all/202502072019.LYoCR9bF-lkp@intel.com/
> > Suggested-by: Arnd Bergmann <arnd@arndb.de>
> > 
> > --
> > 
> > Suggested-by as per Arnd's request, but the only thing I changed was preserving
> > array_size() [as noted by Geert in the linked thread]. I tested and found no
> > regressions.
> 
> You forgot to sign-off on this commit :(
> 
> Can you resend it please with that fixed?

Done, thanks. I used to have format.signOff=true but lost that somewhere...