linux-kernel - Re: [PATCH AUTOSEL 5.16 12/13] spi: Fix invalid sgs value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdVtGb6LCTbDKo9vn=1MmP+RZJTe2=VNTtrNsPa-=1Q6zA@mail.gmail.com>
Date:   Wed, 16 Mar 2022 17:07:28 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     Sasha Levin <sashal@...nel.org>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        stable <stable@...r.kernel.org>,
        Biju Das <biju.das.jz@...renesas.com>,
        Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>,
        Mark Brown <broonie@...nel.org>,
        linux-spi <linux-spi@...r.kernel.org>
Subject: Re: [PATCH AUTOSEL 5.16 12/13] spi: Fix invalid sgs value

Hi Sasha,

On Wed, Mar 16, 2022 at 3:15 PM Sasha Levin <sashal@...nel.org> wrote:
> From: Biju Das <biju.das.jz@...renesas.com>
>
> [ Upstream commit 1a4e53d2fc4f68aa654ad96d13ad042e1a8e8a7d ]

This commit is not 100% correct, cfr.
https://lore.kernel.org/lkml/CAHk-=wiZnS6n1ROQg3FHd=bcVTHi-sKutKT+toiViQEH47ZACg@mail.gmail.com
Please postpone backporting until the issue has been resolved.

>
> max_seg_size is unsigned int and it can have a value up to 2^32
> (for eg:-RZ_DMAC driver sets dma_set_max_seg_size as U32_MAX)
> When this value is used in min_t() as an integer type, it becomes
> -1 and the value of sgs becomes 0.
>
> Fix this issue by replacing the 'int' data type with 'unsigned int'
> in min_t().
>
> Signed-off-by: Biju Das <biju.das.jz@...renesas.com>
> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>
> Reviewed-by: Geert Uytterhoeven <geert+renesas@...der.be>
> Link: https://lore.kernel.org/r/20220307184843.9994-1-biju.das.jz@bp.renesas.com
> Signed-off-by: Mark Brown <broonie@...nel.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  drivers/spi/spi.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
> index 8ba87b7f8f1a..ed4e6983eda0 100644
> --- a/drivers/spi/spi.c
> +++ b/drivers/spi/spi.c
> @@ -1021,10 +1021,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct device *dev,
>         int i, ret;
>
>         if (vmalloced_buf || kmap_buf) {
> -               desc_len = min_t(int, max_seg_size, PAGE_SIZE);
> +               desc_len = min_t(unsigned int, max_seg_size, PAGE_SIZE);
>                 sgs = DIV_ROUND_UP(len + offset_in_page(buf), desc_len);
>         } else if (virt_addr_valid(buf)) {
> -               desc_len = min_t(int, max_seg_size, ctlr->max_dma_len);
> +               desc_len = min_t(unsigned int, max_seg_size, ctlr->max_dma_len);
>                 sgs = DIV_ROUND_UP(len, desc_len);
>         } else {
>                 return -EINVAL;

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds