From: Peter Rosin <peda@axentia.se> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Peter Rosin <peda@axentia.se>, Wolfram Sang <wsa@the-dreams.de>, "Rob Herring" <robh+dt@kernel.org>, Mark Rutland <mark.rutland@arm.com>, "Jonathan Cameron" <jic23@kernel.org>, Hartmut Knaack <knaack.h@gmx.de>, "Lars-Peter Clausen" <lars@metafoo.de>, Peter Meerwald-Stadler <pmeerw@pmeerw.net>, Jonathan Corbet <corbet@lwn.net>, <linux-i2c@vger.kernel.org>, <devicetree@vger.kernel.org>, <linux-kernel@vger.kernel.org>, <linux-iio@vger.kernel.org>, <linux-doc@vger.kernel.org>, Andrew Morton <akpm@linux-foundation.org>, Colin Ian King <colin.king@canonical.com>, "Paul Gortmaker" <paul.gortmaker@windriver.com> Subject: [PATCH v11 11/12] iio: multiplexer: fix unsigned check with less than zero Date: Mon, 27 Mar 2017 14:17:48 +0200 [thread overview] Message-ID: <1490617069-13119-12-git-send-email-peda@axentia.se> (raw) In-Reply-To: <1490617069-13119-1-git-send-email-peda@axentia.se> Comparing a size_t with less than zero is always false as size_t is unsigned. So, change the type of the variable to ssize_t and replicate the size check from mux_configure_channel() into mux_write_ext_info() thus ensuring that the size will fit in the ssize_t variable. Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0") Fixes: 1da8e16d2812 ("iio: multiplexer: new iio category and iio-mux driver") Reported-by: Colin Ian King <colin.king@canonical.com> Acked-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Peter Rosin <peda@axentia.se> --- drivers/iio/multiplexer/iio-mux.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c index 94d40f9bef4c..bab9e6902090 100644 --- a/drivers/iio/multiplexer/iio-mux.c +++ b/drivers/iio/multiplexer/iio-mux.c @@ -21,7 +21,7 @@ struct mux_ext_info_cache { char *data; - size_t size; + ssize_t size; }; struct mux_child { @@ -206,6 +206,9 @@ static ssize_t mux_write_ext_info(struct iio_dev *indio_dev, uintptr_t private, char *new; ssize_t ret; + if (len >= PAGE_SIZE) + return -EINVAL; + ret = iio_mux_select(mux, idx); if (ret < 0) return ret; -- 2.1.4
WARNING: multiple messages have this Message-ID (diff)
From: Peter Rosin <peda@axentia.se> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Peter Rosin <peda@axentia.se>, Wolfram Sang <wsa@the-dreams.de>, Rob Herring <robh+dt@kernel.org>, Mark Rutland <mark.rutland@arm.com>, Jonathan Cameron <jic23@kernel.org>, Hartmut Knaack <knaack.h@gmx.de>, Lars-Peter Clausen <lars@metafoo.de>, Peter Meerwald-Stadler <pmeerw@pmeerw.net>, Jonathan Corbet <corbet@lwn.net>, linux-i2c@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, linux-iio@vger.kernel.org, linux-doc@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>, Colin Ian King <colin.king@canonical.com>, Paul Gortmaker <paul.gortmaker@windriver.com> Subject: [PATCH v11 11/12] iio: multiplexer: fix unsigned check with less than zero Date: Mon, 27 Mar 2017 14:17:48 +0200 [thread overview] Message-ID: <1490617069-13119-12-git-send-email-peda@axentia.se> (raw) In-Reply-To: <1490617069-13119-1-git-send-email-peda@axentia.se> Comparing a size_t with less than zero is always false as size_t is unsigned. So, change the type of the variable to ssize_t and replicate the size check from mux_configure_channel() into mux_write_ext_info() thus ensuring that the size will fit in the ssize_t variable. Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0") Fixes: 1da8e16d2812 ("iio: multiplexer: new iio category and iio-mux driver") Reported-by: Colin Ian King <colin.king@canonical.com> Acked-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Peter Rosin <peda@axentia.se> --- drivers/iio/multiplexer/iio-mux.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c index 94d40f9bef4c..bab9e6902090 100644 --- a/drivers/iio/multiplexer/iio-mux.c +++ b/drivers/iio/multiplexer/iio-mux.c @@ -21,7 +21,7 @@ struct mux_ext_info_cache { char *data; - size_t size; + ssize_t size; }; struct mux_child { @@ -206,6 +206,9 @@ static ssize_t mux_write_ext_info(struct iio_dev *indio_dev, uintptr_t private, char *new; ssize_t ret; + if (len >= PAGE_SIZE) + return -EINVAL; + ret = iio_mux_select(mux, idx); if (ret < 0) return ret; -- 2.1.4
next prev parent reply other threads:[~2017-03-27 12:19 UTC|newest] Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-03-27 12:17 [PATCH v11 00/12] mux controller abstraction and iio/i2c muxes Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 01/12] devres: trivial whitespace fix Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 02/12] dt-bindings: document devicetree bindings for mux-controllers and gpio-mux Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 03/12] mux: minimal mux subsystem and gpio-based mux controller Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 04/12] iio: inkern: api for manipulating ext_info of iio channels Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 05/12] dt-bindings: iio: io-channel-mux: document io-channel-mux bindings Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 06/12] iio: multiplexer: new iio category and iio-mux driver Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 07/12] dt-bindings: i2c: i2c-mux: document general purpose i2c-mux bindings Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 08/12] i2c: i2c-mux-gpmux: new driver Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 09/12] dt-bindings: mux-adg792a: document devicetree bindings for ADG792A/G mux Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` [PATCH v11 10/12] mux: adg792a: add mux controller driver for ADG792A/G Peter Rosin 2017-03-27 12:17 ` Peter Rosin 2017-03-27 12:17 ` Peter Rosin [this message] 2017-03-27 12:17 ` [PATCH v11 11/12] iio: multiplexer: fix unsigned check with less than zero Peter Rosin 2017-03-27 13:06 ` Johan Hovold 2017-03-27 13:06 ` Johan Hovold 2017-03-27 13:46 ` Peter Rosin 2017-03-27 13:46 ` Peter Rosin 2017-03-27 14:03 ` Greg Kroah-Hartman 2017-03-27 14:33 ` Johan Hovold 2017-03-27 12:17 ` [PATCH v11 12/12] mux: core: fix error handling in devm_mux_chip_alloc Peter Rosin 2017-03-27 12:17 ` Peter Rosin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1490617069-13119-12-git-send-email-peda@axentia.se \ --to=peda@axentia.se \ --cc=akpm@linux-foundation.org \ --cc=colin.king@canonical.com \ --cc=corbet@lwn.net \ --cc=devicetree@vger.kernel.org \ --cc=gregkh@linuxfoundation.org \ --cc=jic23@kernel.org \ --cc=knaack.h@gmx.de \ --cc=lars@metafoo.de \ --cc=linux-doc@vger.kernel.org \ --cc=linux-i2c@vger.kernel.org \ --cc=linux-iio@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mark.rutland@arm.com \ --cc=paul.gortmaker@windriver.com \ --cc=pmeerw@pmeerw.net \ --cc=robh+dt@kernel.org \ --cc=wsa@the-dreams.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.