linux-kernel - Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <910dd7ee-9b07-4e43-6ba3-cf5736c94348@axentia.se>
Date:   Wed, 8 Mar 2017 09:59:12 +0100
From:   Peter Rosin <peda@...ntia.se>
To:     Colin King <colin.king@...onical.com>,
        Jonathan Cameron <jic23@...nel.org>,
        Hartmut Knaack <knaack.h@....de>,
        Lars-Peter Clausen <lars@...afoo.de>,
        Peter Meerwald-Stadler <pmeerw@...erw.net>,
        <linux-iio@...r.kernel.org>
CC:     <kernel-janitors@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero

On 2017-03-07 16:06, Colin King wrote:
> From: Colin Ian King <colin.king@...onical.com>
> 
> Comparing a size_t with less than zero is always false as size_t
> is unsigned. The intent of the comparison was to check if the size
> was -1 (that is, undefined), so use that instead.
> 
> Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
> 
> Signed-off-by: Colin Ian King <colin.king@...onical.com>

Hi!

Oops, thanks for highlighting this! However, I think I prefer to instead
change the type of the struct mux_ext_info_cache member 'size' to ssize_t.
That way, there is no annoying explicit cast. And perhaps add an early
check

	if (len >= PAGE_SIZE)
		return -EINVAL;

to mux_write_ext_info (because the sysfs read function in use for iio ext
info can't handle more than a page anyway, IIUC). That way it is fairly
certain that the ssize_t type will always be big enough. :-)

So, I'm going send out a patch like that instead, unless someone happens to
beat me to it...

Cheers,
peda

> ---
>  drivers/iio/multiplexer/iio-mux.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
> index 94d40f9b..6c23033 100644
> --- a/drivers/iio/multiplexer/iio-mux.c
> +++ b/drivers/iio/multiplexer/iio-mux.c
> @@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
>  
>  			cache = &child->ext_info_cache[i];
>  
> -			if (cache->size < 0)
> +			if (cache->size == (size_t)-1)
>  				continue;
>  
>  			ret = iio_write_channel_ext_info(mux->parent, attr,
>