| Message ID | 20190330212300.11675-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | spi: oc-tiny: fix negative loop bound error on for loop | expand |
On 3/31/2019 2:53 AM, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > Currently the for-loop using an unsigned int for the loop counter > which is problematic when comparing it to the signed int > gt->gpio_cs_count. This is an issue because if the signed int is > negative (for example, the call to of_gpio_count failed) then > the negative loop bound is implicitly cast to an unsigned int on > the comparison to loop counter i and will yield a very large value, > eventually causing an array bounds overflow on hw->gpio_cs. > > Fix this by simply making the loop counter i a signed int; > > Fixes: ca632f556697 ("spi: reorganize drivers") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/spi/spi-oc-tiny.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c > index 085f580be7ec..81f74b938dc9 100644 > --- a/drivers/spi/spi-oc-tiny.c > +++ b/drivers/spi/spi-oc-tiny.c > @@ -206,7 +206,7 @@ static int tiny_spi_of_probe(struct platform_device *pdev) > { > struct tiny_spi *hw = platform_get_drvdata(pdev); > struct device_node *np = pdev->dev.of_node; > - unsigned int i; > + int i; same here as well you are putting wrapper over a original issue by not checking the returned value. Please fix that in both patches. Thanks. Mukesh > u32 val; > > if (!np)
On 3/31/2019 2:53 AM, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > Currently the for-loop using an unsigned int for the loop counter > which is problematic when comparing it to the signed int > gt->gpio_cs_count. This is an issue because if the signed int is > negative (for example, the call to of_gpio_count failed) then > the negative loop bound is implicitly cast to an unsigned int on > the comparison to loop counter i and will yield a very large value, > eventually causing an array bounds overflow on hw->gpio_cs. > > Fix this by simply making the loop counter i a signed int; > > Fixes: ca632f556697 ("spi: reorganize drivers") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/spi/spi-oc-tiny.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c > index 085f580be7ec..81f74b938dc9 100644 > --- a/drivers/spi/spi-oc-tiny.c > +++ b/drivers/spi/spi-oc-tiny.c > @@ -206,7 +206,7 @@ static int tiny_spi_of_probe(struct platform_device *pdev) > { > struct tiny_spi *hw = platform_get_drvdata(pdev); > struct device_node *np = pdev->dev.of_node; > - unsigned int i; > + int i; Same issue, here as well like your other patch. you are putting wrapper over a original issue by not checking the returned value. Please fix that in both patches. Thanks. Mukesh > u32 val; > > if (!np)
On Sat, Mar 30, 2019 at 09:23:00PM +0000, Colin King wrote:
> Fixes: ca632f556697 ("spi: reorganize drivers")
Please think about the fixes tags you're applying, this is obviously not
the source of the issue.
diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c index 085f580be7ec..81f74b938dc9 100644 --- a/drivers/spi/spi-oc-tiny.c +++ b/drivers/spi/spi-oc-tiny.c @@ -206,7 +206,7 @@ static int tiny_spi_of_probe(struct platform_device *pdev) { struct tiny_spi *hw = platform_get_drvdata(pdev); struct device_node *np = pdev->dev.of_node; - unsigned int i; + int i; u32 val; if (!np)