linux-kernel - Re: samsung-galaxybook writes to a int via a u8*

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c6f87174-8ab1-40ae-bf7d-601caee89784@gmx.de>
Date: Sun, 28 Dec 2025 21:16:05 +0100
From: Armin Wolf <W_Armin@....de>
To: Gianni Ceccarelli <dakkar@...nautilus.net>,
 Joshua Grisham <josh@...huagrisham.com>
Cc: platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: samsung-galaxybook writes to a int via a u8*

Am 28.12.25 um 12:55 schrieb Gianni Ceccarelli:

> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/samsung-galaxybook.c#n450
>
> `val->intval` is an int (see
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/linux/power_supply.h#n228
> ), so writing to it via a `u8*` produces weird results, for example:
>
>      $ cat /sys/class/power_supply/BAT1/charge_control_end_threshold
>      78497792
>      $ grep END_THRESHOLD /sys/class/power_supply/BAT1/uevent
>      POWER_SUPPLY_CHARGE_CONTROL_END_THRESHOLD=-962691840
>
> The least-significant byte of numbers values contains the expected
> value:
>
>      $ perl -E 'say 78497792 & 0xFF'
>      0
>      $ perl -E 'say -962691840 & 0xFF'
>      0
>
> even after changing the threshold:
>      
>      # echo 90 >
> /sys/class/power_supply/BAT1/charge_control_end_threshold $ cat
> /sys/class/power_supply/BAT1/charge_control_end_threshold 78497882
>      $ grep END_THRESHOLD /sys/class/power_supply/BAT1/uevent
>      POWER_SUPPLY_CHARGE_CONTROL_END_THRESHOLD=-966918822
>      $ perl -E 'say 78497882 & 0xFF'
>      90
>      $ perl -E 'say -966918822 & 0xFF'
>      90
>
> I guess the code could be changed to:
>
>      u8 byteval;
>      err = charge_control_end_threshold_acpi_get(galaxybook, &byteval);
>      if (err)
>         return err;
>      val->intval = byteval;
>
> Hope this helps.
>
Thanks for your report, this pointer cast indeed seems to be the root cause of the strange values
returned by charge_control_end_threshold. I attached a patch for you to test that implements you suggestion.

Thanks,
Armin Wolf

View attachment "0001-platform-x86-samsung-galaxybook-Fix-problematic-poin.patch" of type "text/x-patch" (1986 bytes)