linux-kernel - RE: [PATCH] iio: addac: ad74413r: fix integer promotion bug in ad74413_get_input_current

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 Nov 2022 13:17:29 +0000
From:   "Sa, Nuno" <Nuno.Sa@...log.com>
To:     Rasmus Villemoes <linux@...musvillemoes.dk>,
        "Tanislav, Cosmin" <Cosmin.Tanislav@...log.com>,
        Lars-Peter Clausen <lars@...afoo.de>,
        "Hennerich, Michael" <Michael.Hennerich@...log.com>,
        Jonathan Cameron <jic23@...nel.org>
CC:     "linux-iio@...r.kernel.org" <linux-iio@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] iio: addac: ad74413r: fix integer promotion bug in
 ad74413_get_input_current_offset()

> From: Rasmus Villemoes <linux@...musvillemoes.dk>
> Sent: Friday, November 18, 2022 1:32 PM
> To: Tanislav, Cosmin <Cosmin.Tanislav@...log.com>; Lars-Peter Clausen
> <lars@...afoo.de>; Hennerich, Michael <Michael.Hennerich@...log.com>;
> Jonathan Cameron <jic23@...nel.org>
> Cc: Rasmus Villemoes <linux@...musvillemoes.dk>; linux-
> iio@...r.kernel.org; linux-kernel@...r.kernel.org
> Subject: [PATCH] iio: addac: ad74413r: fix integer promotion bug in
> ad74413_get_input_current_offset()
> 
> [External]
> 
> The constant AD74413R_ADC_RESULT_MAX is defined via GENMASK, so its
> type is "unsigned long".
> 
> Hence in the expression voltage_offset * AD74413R_ADC_RESULT_MAX,
> voltage_offset is first promoted to unsigned long, and since it may be
> negative, that results in a garbage value. For example, when range is
> AD74413R_ADC_RANGE_5V_BI_DIR, voltage_offset is -2500 and
> voltage_range is 5000, so the RHS of this assignment is, depending on
> sizeof(long), either 826225UL or 3689348814709142UL, which after
> truncation to int then results in either 826225 or 1972216214 being
> the output from in_currentX_offset.
> 
> Casting to int avoids that promotion and results in the correct -32767
> output.
> 
> Signed-off-by: Rasmus Villemoes <linux@...musvillemoes.dk>
> ---

After adding proper Fixes: tag,

Reviewed-by: Nuno Sá <nuno.sa@...log.com>