linux-kernel - [PATCH] NFC: fdp: fix signed less or equal zero check in u8 max

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180130153359.524-1-colin.king@canonical.com>
Date:   Tue, 30 Jan 2018 15:33:59 +0000
From:   Colin King <colin.king@...onical.com>
To:     Samuel Ortiz <sameo@...ux.intel.com>,
        "David S . Miller" <davem@...emloft.net>,
        Johannes Berg <johannes.berg@...el.com>,
        linux-wireless@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] NFC: fdp: fix signed less or equal zero check in u8 max_size

From: Colin Ian King <colin.king@...onical.com>

The u8 variable max_size is being assigned a return value from the
call to nci_conn_max_data_pkt_payload_size that can return a -ve
error return. Since max_size is a u8, the -ve check for the error will
always be false. Fix this by making max_size an int type.

Detected using Coccinelle:
drivers/nfc/fdp/fdp.c:208:5-13: WARNING: Unsigned expression compared
with zero: max_size <= 0

Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver")
Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/nfc/fdp/fdp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
index d5784a47fc13..5ddc01b4913a 100644
--- a/drivers/nfc/fdp/fdp.c
+++ b/drivers/nfc/fdp/fdp.c
@@ -192,8 +192,8 @@ static int fdp_nci_send_patch(struct nci_dev *ndev, u8 conn_id, u8 type)
 	const struct firmware *fw;
 	struct sk_buff *skb;
 	unsigned long len;
-	u8 max_size, payload_size;
-	int rc = 0;
+	u8 payload_size;
+	int max_size, rc = 0;
 
 	if ((type == NCI_PATCH_TYPE_OTP && !info->otp_patch) ||
 	    (type == NCI_PATCH_TYPE_RAM && !info->ram_patch))
-- 
2.15.1