From: Colin Ian King <colin.king@canonical.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jiri Kosina <jikos@kernel.org>,
Benjamin Tissoires <benjamin.tissoires@redhat.com>,
Nestor Lopez Casado <nlopezcasad@logitech.com>,
linux-input@vger.kernel.org, kernel-janitors@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] HID: logitech-dj: fix unintentional integer overflow on left shift
Date: Mon, 8 Feb 2021 15:07:33 +0000 [thread overview]
Message-ID: <7f79107a-93ad-251d-33bd-9a2cf2748aa9@canonical.com> (raw)
In-Reply-To: <20210208150610.GI2696@kadam>
On 08/02/2021 15:06, Dan Carpenter wrote:
> On Sun, Feb 07, 2021 at 11:21:20PM +0000, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> Shifting the integer value 1 is evaluated using 32-bit rithmetic
>> and then used in an expression that expects a 64-bit value, so
>> there is potentially an integer overflow. Fix this by using th
>> BIT_ULL macro to perform the shift and avoid the overflow.
>>
>> Addresses-Coverity: ("Uninitentional integer overflow")
>> Fixes: 534a7b8e10ec ("HID: Add full support for Logitech Unifying receivers")
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>> ---
>> drivers/hid/hid-logitech-dj.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
>> index 45e7e0bdd382..747f41be0603 100644
>> --- a/drivers/hid/hid-logitech-dj.c
>> +++ b/drivers/hid/hid-logitech-dj.c
>> @@ -1035,7 +1035,7 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
>> memset(reportbuffer, 0, sizeof(reportbuffer));
>>
>> for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) {
> ^^^^^^^^^^^^^^^^^^^^^
> This is 32, so it can't be undefined.
Urgh, looks like coverity is being overly pedantic here. :-(
>
>> - if (djdev->reports_supported & (1 << i)) {
>> + if (djdev->reports_supported & BIT_ULL(i)) {
>> reportbuffer[0] = i;
>> if (hid_input_report(djdev->hdev,
>> HID_INPUT_REPORT,
>
> regards,
> dan carpenter
>
WARNING: multiple messages have this Message-ID (diff)
From: Colin Ian King <colin.king@canonical.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jiri Kosina <jikos@kernel.org>,
Benjamin Tissoires <benjamin.tissoires@redhat.com>,
Nestor Lopez Casado <nlopezcasad@logitech.com>,
linux-input@vger.kernel.org, kernel-janitors@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] HID: logitech-dj: fix unintentional integer overflow on left shift
Date: Mon, 08 Feb 2021 15:07:33 +0000 [thread overview]
Message-ID: <7f79107a-93ad-251d-33bd-9a2cf2748aa9@canonical.com> (raw)
In-Reply-To: <20210208150610.GI2696@kadam>
On 08/02/2021 15:06, Dan Carpenter wrote:
> On Sun, Feb 07, 2021 at 11:21:20PM +0000, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> Shifting the integer value 1 is evaluated using 32-bit rithmetic
>> and then used in an expression that expects a 64-bit value, so
>> there is potentially an integer overflow. Fix this by using th
>> BIT_ULL macro to perform the shift and avoid the overflow.
>>
>> Addresses-Coverity: ("Uninitentional integer overflow")
>> Fixes: 534a7b8e10ec ("HID: Add full support for Logitech Unifying receivers")
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>> ---
>> drivers/hid/hid-logitech-dj.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
>> index 45e7e0bdd382..747f41be0603 100644
>> --- a/drivers/hid/hid-logitech-dj.c
>> +++ b/drivers/hid/hid-logitech-dj.c
>> @@ -1035,7 +1035,7 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
>> memset(reportbuffer, 0, sizeof(reportbuffer));
>>
>> for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) {
> ^^^^^^^^^^^^^^^^^^^^^
> This is 32, so it can't be undefined.
Urgh, looks like coverity is being overly pedantic here. :-(
>
>> - if (djdev->reports_supported & (1 << i)) {
>> + if (djdev->reports_supported & BIT_ULL(i)) {
>> reportbuffer[0] = i;
>> if (hid_input_report(djdev->hdev,
>> HID_INPUT_REPORT,
>
> regards,
> dan carpenter
>
next prev parent reply other threads:[~2021-02-08 15:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-07 23:21 [PATCH] HID: logitech-dj: fix unintentional integer overflow on left shift Colin King
2021-02-07 23:21 ` Colin King
2021-02-08 15:06 ` Dan Carpenter
2021-02-08 15:06 ` Dan Carpenter
2021-02-08 15:07 ` Colin Ian King [this message]
2021-02-08 15:07 ` Colin Ian King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7f79107a-93ad-251d-33bd-9a2cf2748aa9@canonical.com \
--to=colin.king@canonical.com \
--cc=benjamin.tissoires@redhat.com \
--cc=dan.carpenter@oracle.com \
--cc=jikos@kernel.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nlopezcasad@logitech.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.