linux-kernel - Re: [PATCH] firmware: arm_scpi: prevent ternary sign expansion bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <161960405992.396847.5531876675862211477.b4-ty@arm.com>
Date:   Wed, 28 Apr 2021 11:03:06 +0100
From:   Sudeep Holla <sudeep.holla@....com>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     Sudeep Holla <sudeep.holla@....com>,
        kernel-janitors@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        Cristian Marussi <cristian.marussi@....com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] firmware: arm_scpi: prevent ternary sign expansion bug

On Thu, 22 Apr 2021 12:02:29 +0300, Dan Carpenter wrote:
> How type promotion works in ternary expressions is a bit tricky.
> The problem is that scpi_clk_get_val() returns longs, "ret" is a int
> which holds a negative error code, and le32_to_cpu() is an unsigned int.
> We want the negative error code to be cast to a negative long.  But
> because le32_to_cpu() is an u32 then "ret" is type promoted to u32 and
> becomes a high positive and then it is promoted to long and it is still
> a high positive value.
>
> [...]

Applied to sudeep.holla/linux (for-next/scmi), thanks!

[1/1] firmware: arm_scpi: prevent ternary sign expansion bug
      https://git.kernel.org/sudeep.holla/c/d9cd78edb2

--
Regards,
Sudeep