linux-kernel - Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <687fdd3a-4e0d-1eda-e8fc-27173c611909@canonical.com>
Date:   Wed, 8 Mar 2017 09:03:19 +0000
From:   Colin Ian King <colin.king@...onical.com>
To:     Peter Rosin <peda@...ntia.se>, Jonathan Cameron <jic23@...nel.org>,
        Hartmut Knaack <knaack.h@....de>,
        Lars-Peter Clausen <lars@...afoo.de>,
        Peter Meerwald-Stadler <pmeerw@...erw.net>,
        linux-iio@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero

On 08/03/17 08:59, Peter Rosin wrote:
> On 2017-03-07 16:06, Colin King wrote:
>> From: Colin Ian King <colin.king@...onical.com>
>>
>> Comparing a size_t with less than zero is always false as size_t
>> is unsigned. The intent of the comparison was to check if the size
>> was -1 (that is, undefined), so use that instead.
>>
>> Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
>>
>> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> 
> Hi!
> 
> Oops, thanks for highlighting this! However, I think I prefer to instead
> change the type of the struct mux_ext_info_cache member 'size' to ssize_t.
> That way, there is no annoying explicit cast. And perhaps add an early
> check
> 
> 	if (len >= PAGE_SIZE)
> 		return -EINVAL;
> 
> to mux_write_ext_info (because the sysfs read function in use for iio ext
> info can't handle more than a page anyway, IIUC). That way it is fairly
> certain that the ssize_t type will always be big enough. :-)

Sounds like a far better solution.

> 
> So, I'm going send out a patch like that instead, unless someone happens to
> beat me to it...
> 
> Cheers,
> peda

Thanks,

Colin
> 
>> ---
>>  drivers/iio/multiplexer/iio-mux.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
>> index 94d40f9b..6c23033 100644
>> --- a/drivers/iio/multiplexer/iio-mux.c
>> +++ b/drivers/iio/multiplexer/iio-mux.c
>> @@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
>>  
>>  			cache = &child->ext_info_cache[i];
>>  
>> -			if (cache->size < 0)
>> +			if (cache->size == (size_t)-1)
>>  				continue;
>>  
>>  			ret = iio_write_channel_ext_info(mux->parent, attr,
>>
>