Re: [PATCH v9 4/5] gpio: rpmsg: add support for NXP legacy firmware protocol
From: Dan Carpenter
Date: Fri Mar 06 2026 - 02:36:06 EST
Hi Shenwei,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Shenwei-Wang/docs-driver-api-gpio-rpmsg-gpio-driver-over-rpmsg-bus/20260305-052440
base: https://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git gpio/for-next
patch link: https://lore.kernel.org/r/20260304211808.1437846-5-shenwei.wang%40nxp.com
patch subject: [PATCH v9 4/5] gpio: rpmsg: add support for NXP legacy firmware protocol
config: x86_64-randconfig-161-20260306 (https://download.01.org/0day-ci/archive/20260306/202603060910.Q5zBquzF-lkp@xxxxxxxxx/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
| Closes: https://lore.kernel.org/r/202603060910.Q5zBquzF-lkp@xxxxxxxxx/
smatch warnings:
drivers/gpio/gpio-rpmsg.c:188 rpmsg_gpio_imx_send_fixed_up() error: buffer overflow 'imx_std_cmd_map' 7 <= 27
vim +/imx_std_cmd_map +188 drivers/gpio/gpio-rpmsg.c
49a0cb20cd49a59 Shenwei Wang 2026-03-04 176 static int rpmsg_gpio_imx_send_fixed_up(struct rpmsg_gpio_info *info,
49a0cb20cd49a59 Shenwei Wang 2026-03-04 177 struct rpmsg_gpio_packet *msg)
49a0cb20cd49a59 Shenwei Wang 2026-03-04 178 {
49a0cb20cd49a59 Shenwei Wang 2026-03-04 179 struct rpmsg_gpio_nxp_packet imx_msg;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 180
49a0cb20cd49a59 Shenwei Wang 2026-03-04 181 if (msg->cmd >= sizeof(imx_std_cmd_map))
This looks like a sizeof() vs ARRAY_SIZE() bug.
49a0cb20cd49a59 Shenwei Wang 2026-03-04 182 return -EINVAL;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 183
49a0cb20cd49a59 Shenwei Wang 2026-03-04 184 imx_msg.id = IMX_RPMSG_ID;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 185 imx_msg.vendor = IMX_RPMSG_VENDOR;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 186 imx_msg.version = IMX_RPMSG_VERSION;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 187 imx_msg.type = msg->type;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 @188 imx_msg.cmd = imx_std_cmd_map[msg->cmd];
^^^^^^^^
Out of bounds.
49a0cb20cd49a59 Shenwei Wang 2026-03-04 189 imx_msg.port_idx = msg->port_idx;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 190 imx_msg.line = msg->line;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 191 imx_msg.val1 = msg->val1;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 192 imx_msg.val2 = msg->val2;
49a0cb20cd49a59 Shenwei Wang 2026-03-04 193
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki