From patchwork Tue Jul 26 15:19:45 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 9248327 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9E55460757 for ; Tue, 26 Jul 2016 15:19:56 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8FAFE26A4D for ; Tue, 26 Jul 2016 15:19:56 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 83D4B26D08; Tue, 26 Jul 2016 15:19:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7D70C26A4D for ; Tue, 26 Jul 2016 15:19:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754042AbcGZPTy (ORCPT ); Tue, 26 Jul 2016 11:19:54 -0400 Received: from bh-25.webhostbox.net ([208.91.199.152]:35645 "EHLO bh-25.webhostbox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753799AbcGZPTy (ORCPT ); Tue, 26 Jul 2016 11:19:54 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=roeck-us.net; s=default; h=Message-Id:Date:Subject:Cc:To:From; bh=NwUSzX1tS7yLFMCE4RhT8uICeHAd3UeXksNoBfgU9jc=; b=k1YSuMD1rlmWy2HvL/7JVK3gOG 7tvglOoDcjVGeG14GQqrldVtdtTCTn/wFmD/o+QvIJFcSe+vI4J5fz5babA2DNwxKQcFjBH+CIY44 edZG9jEcGiwsWaonovFV1zdyWi7sKWh1sKAP4zLIj82IFsn6ZWJHWzWlGrwaTSGUQsowZZhK/EbZE rNS28BgXdHcadbq5Vgi4e+5jqCQVVxuHiB7qK3ITHx+rXvgyL8Y+WuUj7rQMcV2Z+W457CtrTzFXE WLIdAKKpU6lILpuN3KNscYiQbO7gF3ajXoQ7ow76KbcxJIbXXd985+V2fRcWwdaVVEKL3n3hO4M33 S+wNrgvw==; Received: from 108-223-40-66.lightspeed.sntcca.sbcglobal.net ([108.223.40.66]:37478 helo=localhost) by bh-25.webhostbox.net with esmtpa (Exim 4.86_1) (envelope-from ) id 1bS498-003Rs5-7N; Tue, 26 Jul 2016 15:19:52 +0000 From: Guenter Roeck To: Hardware Monitoring Cc: Jean Delvare , Guenter Roeck , Thilo Cestonaro Subject: [PATCH] hwmon: (ftsteutates) Fix potential memory access error Date: Tue, 26 Jul 2016 08:19:45 -0700 Message-Id: <1469546388-29907-1-git-send-email-linux@roeck-us.net> X-Mailer: git-send-email 2.5.0 X-Authenticated_sender: guenter@roeck-us.net X-OutGoing-Spam-Status: No, score=-1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - bh-25.webhostbox.net X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - roeck-us.net X-Get-Message-Sender-Via: bh-25.webhostbox.net: authenticated_id: guenter@roeck-us.net X-Authenticated-Sender: bh-25.webhostbox.net: guenter@roeck-us.net X-Source: X-Source-Args: X-Source-Dir: Sender: linux-hwmon-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-hwmon@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Using set_bit() to set a bit in an integer is not a good idea, since the function expects an unsigned long as argument, which can be 64 bit wide. Coverity reports this problem as >>> CID 1364488: Memory - illegal accesses (INCOMPATIBLE_CAST) >>> Pointer "&ret" points to an object whose effective type is "int" >>> (32 bits, signed) but is dereferenced as a wider "unsigned +long" (64 bits, unsigned). This may lead to memory corruption. 245 set_bit(1, (unsigned long *)&ret); Just use BIT instead. Cc: Thilo Cestonaro Signed-off-by: Guenter Roeck --- drivers/hwmon/ftsteutates.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c index 2b2ff67026be..48633e541dc3 100644 --- a/drivers/hwmon/ftsteutates.c +++ b/drivers/hwmon/ftsteutates.c @@ -242,7 +242,7 @@ static int fts_wd_set_resolution(struct fts_data *data, } if (resolution == seconds) - set_bit(1, (unsigned long *)&ret); + ret |= BIT(1); else ret &= ~BIT(1);