linux-kernel - [PATCH] ASoC: cs35l56: Prevent bad sign extension in cs35l56_read_silicon

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 27 Feb 2024 10:00:42 +0000
From: Richard Fitzgerald <rf@...nsource.cirrus.com>
To: <broonie@...nel.org>, <tiwai@...e.com>
CC: <alsa-devel@...a-project.org>, <linux-sound@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <patches@...nsource.cirrus.com>,
        "Richard
 Fitzgerald" <rf@...nsource.cirrus.com>
Subject: [PATCH] ASoC: cs35l56: Prevent bad sign extension in cs35l56_read_silicon_uid()

Cast u8 values to u32 when using them to build a 32-bit unsigned value
that is then stored in a u64. This avoids the possibility of a bad sign
extension where the u8 is implicitly extended to an int, thus changing it
from an unsigned to a signed value.

Whether this is a real problem is debatable, but it does no harm to
ensure that the u8 are cast to a suitable type for shifting.

Signed-off-by: Richard Fitzgerald <rf@...nsource.cirrus.com>
Fixes: e1830f66f6c6 ("ASoC: cs35l56: Add helper functions for amp calibration")
---
 sound/soc/codecs/cs35l56-shared.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/cs35l56-shared.c b/sound/soc/codecs/cs35l56-shared.c
index 20b6dbd3fbab..f3670bf85a95 100644
--- a/sound/soc/codecs/cs35l56-shared.c
+++ b/sound/soc/codecs/cs35l56-shared.c
@@ -659,9 +659,10 @@ static int cs35l56_read_silicon_uid(struct cs35l56_base *cs35l56_base, u64 *uid)
 		return ret;
 	}
 
-	unique_id = pte.lot[2] | (pte.lot[1] << 8) | (pte.lot[0] << 16);
+	unique_id = (u32)pte.lot[2] | ((u32)pte.lot[1] << 8) | ((u32)pte.lot[0] << 16);
 	unique_id <<= 32;
-	unique_id |= pte.x | (pte.y << 8) | (pte.wafer_id << 16) | (pte.dvs << 24);
+	unique_id |= (u32)pte.x | ((u32)pte.y << 8) | ((u32)pte.wafer_id << 16) |
+		     ((u32)pte.dvs << 24);
 
 	dev_dbg(cs35l56_base->dev, "UniqueID = %#llx\n", unique_id);
 
-- 
2.39.2