linux-kernel - Re: [PATCH] spi: spi-fsl-lpspi: fix watermark truncation caused by type cast

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251122104842.6a9cdbd1@pumpkin>
Date: Sat, 22 Nov 2025 10:48:42 +0000
From: david laight <david.laight@...box.com>
To: carlos.song@....com
Cc: Frank.Li@....com, broonie@...nel.org, rongqianfeng@...o.com,
 linux-spi@...r.kernel.org, imx@...ts.linux.dev,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] spi: spi-fsl-lpspi: fix watermark truncation caused by
 type cast

On Mon, 17 Nov 2025 11:03:55 +0800
carlos.song@....com wrote:

> From: Carlos Song <carlos.song@....com>
> 
> 't->len' is an unsigned integer, while 'watermark' and 'txfifosize' are
> u8. Using min_t with typeof(watermark) forces both values to be cast to
> u8, which truncates len when it exceeds 255. For example, len = 4096
> becomes 0 after casting, resulting in an incorrect watermark value.
> 
> Use a wider type in min_t to avoid truncation and ensure the correct
> minimum value is applied.

Also see my big patch that will detect this...

It usual that a simple min() will work fine.
(After the relaxation of the type comparison in min().)
If one of the values is a signed type (but positive) use umin(a,b).

This is a typical example of the type of the destination being used in min_t().
The real fix is to remove min_t() completely.

After all if the code had been:
	sl_lpspi->watermark = min(sl_lpspi->txfifosize,
		(typeof(fsl_lpspi->watermark))t->len);
a reviewer would have been likely to pick up the truncation.

Hiding the cast inside min_t() is a 'really bad idea' (tm).

I've found a pile of cases of:
	min_t(u8, value_32 / 2, 255)
in one driver (and the variable is pretty much called 'value_32'.

Looks like I've tried to compile this file yet.
'git diff' is currently outputting 8395 files for 358 files.

	David

> 
> Fixes: a750050349ea ("spi: spi-fsl-lpspi: use min_t() to improve code")
> Signed-off-by: Carlos Song <carlos.song@....com>
> ---
>  drivers/spi/spi-fsl-lpspi.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
> index 8da66e101386..065456aba2ae 100644
> --- a/drivers/spi/spi-fsl-lpspi.c
> +++ b/drivers/spi/spi-fsl-lpspi.c
> @@ -486,7 +486,13 @@ static int fsl_lpspi_setup_transfer(struct spi_controller *controller,
>  		fsl_lpspi->tx = fsl_lpspi_buf_tx_u32;
>  	}
>  
> -	fsl_lpspi->watermark = min_t(typeof(fsl_lpspi->watermark),
> +	/*
> +	 * t->len is 'unsigned' and txfifosize and watermrk is 'u8', force
> +	 * type cast is inevitable. When len > 255, len will be truncated in min_t(),
> +	 * it caused wrong watermark set. 'unsigned int' is as the designated type
> +	 * for min_t() to avoid truncation.
> +	 */
> +	fsl_lpspi->watermark = min_t(unsigned int,
>  				     fsl_lpspi->txfifosize,
>  				     t->len);
>