linux-kernel - samsung-galaxybook writes to a int via a u8*

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251228115556.14362d66@thenautilus.net>
Date: Sun, 28 Dec 2025 11:55:56 +0000
From: Gianni Ceccarelli <dakkar@...nautilus.net>
To: Joshua Grisham <josh@...huagrisham.com>
Cc: platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: samsung-galaxybook writes to a int via a u8*

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/samsung-galaxybook.c#n450

`val->intval` is an int (see
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/linux/power_supply.h#n228
), so writing to it via a `u8*` produces weird results, for example:

    $ cat /sys/class/power_supply/BAT1/charge_control_end_threshold
    78497792
    $ grep END_THRESHOLD /sys/class/power_supply/BAT1/uevent
    POWER_SUPPLY_CHARGE_CONTROL_END_THRESHOLD=-962691840

The least-significant byte of numbers values contains the expected
value:

    $ perl -E 'say 78497792 & 0xFF'
    0
    $ perl -E 'say -962691840 & 0xFF'
    0

even after changing the threshold:
    
    # echo 90 >
/sys/class/power_supply/BAT1/charge_control_end_threshold $ cat
/sys/class/power_supply/BAT1/charge_control_end_threshold 78497882
    $ grep END_THRESHOLD /sys/class/power_supply/BAT1/uevent
    POWER_SUPPLY_CHARGE_CONTROL_END_THRESHOLD=-966918822
    $ perl -E 'say 78497882 & 0xFF'
    90
    $ perl -E 'say -966918822 & 0xFF'
    90

I guess the code could be changed to:

    u8 byteval;
    err = charge_control_end_threshold_acpi_get(galaxybook, &byteval);
    if (err)
       return err;
    val->intval = byteval;

Hope this helps.

-- 
	Dakkar - <Mobilis in mobile>
	GPG public key fingerprint = A071 E618 DD2C 5901 9574
	                             6FE2 40EA 9883 7519 3F88
	                    key id = 0x75193F88