* [PATCH] iio: multiplexer: fix unsigned check with less than zero
@ 2017-03-07 15:06 ` Colin King
0 siblings, 0 replies; 9+ messages in thread
From: Colin King @ 2017-03-07 15:06 UTC (permalink / raw)
To: Peter Rosin, Jonathan Cameron, Hartmut Knaack,
Lars-Peter Clausen, Peter Meerwald-Stadler, linux-iio
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
Comparing a size_t with less than zero is always false as size_t
is unsigned. The intent of the comparison was to check if the size
was -1 (that is, undefined), so use that instead.
Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/iio/multiplexer/iio-mux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
index 94d40f9b..6c23033 100644
--- a/drivers/iio/multiplexer/iio-mux.c
+++ b/drivers/iio/multiplexer/iio-mux.c
@@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
cache = &child->ext_info_cache[i];
- if (cache->size < 0)
+ if (cache->size == (size_t)-1)
continue;
ret = iio_write_channel_ext_info(mux->parent, attr,
--
2.10.2
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH] iio: multiplexer: fix unsigned check with less than zero
@ 2017-03-07 15:06 ` Colin King
0 siblings, 0 replies; 9+ messages in thread
From: Colin King @ 2017-03-07 15:06 UTC (permalink / raw)
To: Peter Rosin, Jonathan Cameron, Hartmut Knaack,
Lars-Peter Clausen, Peter Meerwald-Stadler, linux-iio
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
Comparing a size_t with less than zero is always false as size_t
is unsigned. The intent of the comparison was to check if the size
was -1 (that is, undefined), so use that instead.
Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/iio/multiplexer/iio-mux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
index 94d40f9b..6c23033 100644
--- a/drivers/iio/multiplexer/iio-mux.c
+++ b/drivers/iio/multiplexer/iio-mux.c
@@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
cache = &child->ext_info_cache[i];
- if (cache->size < 0)
+ if (cache->size = (size_t)-1)
continue;
ret = iio_write_channel_ext_info(mux->parent, attr,
--
2.10.2
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero
2017-03-07 15:06 ` Colin King
@ 2017-03-08 8:59 ` Peter Rosin
-1 siblings, 0 replies; 9+ messages in thread
From: Peter Rosin @ 2017-03-08 8:59 UTC (permalink / raw)
To: Colin King, Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen,
Peter Meerwald-Stadler, linux-iio
Cc: kernel-janitors, linux-kernel
On 2017-03-07 16:06, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> Comparing a size_t with less than zero is always false as size_t
> is unsigned. The intent of the comparison was to check if the size
> was -1 (that is, undefined), so use that instead.
>
> Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Hi!
Oops, thanks for highlighting this! However, I think I prefer to instead
change the type of the struct mux_ext_info_cache member 'size' to ssize_t.
That way, there is no annoying explicit cast. And perhaps add an early
check
if (len >= PAGE_SIZE)
return -EINVAL;
to mux_write_ext_info (because the sysfs read function in use for iio ext
info can't handle more than a page anyway, IIUC). That way it is fairly
certain that the ssize_t type will always be big enough. :-)
So, I'm going send out a patch like that instead, unless someone happens to
beat me to it...
Cheers,
peda
> ---
> drivers/iio/multiplexer/iio-mux.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
> index 94d40f9b..6c23033 100644
> --- a/drivers/iio/multiplexer/iio-mux.c
> +++ b/drivers/iio/multiplexer/iio-mux.c
> @@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
>
> cache = &child->ext_info_cache[i];
>
> - if (cache->size < 0)
> + if (cache->size == (size_t)-1)
> continue;
>
> ret = iio_write_channel_ext_info(mux->parent, attr,
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero
@ 2017-03-08 8:59 ` Peter Rosin
0 siblings, 0 replies; 9+ messages in thread
From: Peter Rosin @ 2017-03-08 8:59 UTC (permalink / raw)
To: Colin King, Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen,
Peter Meerwald-Stadler, linux-iio
Cc: kernel-janitors, linux-kernel
On 2017-03-07 16:06, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> Comparing a size_t with less than zero is always false as size_t
> is unsigned. The intent of the comparison was to check if the size
> was -1 (that is, undefined), so use that instead.
>
> Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Hi!
Oops, thanks for highlighting this! However, I think I prefer to instead
change the type of the struct mux_ext_info_cache member 'size' to ssize_t.
That way, there is no annoying explicit cast. And perhaps add an early
check
if (len >= PAGE_SIZE)
return -EINVAL;
to mux_write_ext_info (because the sysfs read function in use for iio ext
info can't handle more than a page anyway, IIUC). That way it is fairly
certain that the ssize_t type will always be big enough. :-)
So, I'm going send out a patch like that instead, unless someone happens to
beat me to it...
Cheers,
peda
> ---
> drivers/iio/multiplexer/iio-mux.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
> index 94d40f9b..6c23033 100644
> --- a/drivers/iio/multiplexer/iio-mux.c
> +++ b/drivers/iio/multiplexer/iio-mux.c
> @@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
>
> cache = &child->ext_info_cache[i];
>
> - if (cache->size < 0)
> + if (cache->size = (size_t)-1)
> continue;
>
> ret = iio_write_channel_ext_info(mux->parent, attr,
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero
2017-03-08 8:59 ` Peter Rosin
@ 2017-03-08 9:03 ` Colin Ian King
-1 siblings, 0 replies; 9+ messages in thread
From: Colin Ian King @ 2017-03-08 9:03 UTC (permalink / raw)
To: Peter Rosin, Jonathan Cameron, Hartmut Knaack,
Lars-Peter Clausen, Peter Meerwald-Stadler, linux-iio
Cc: kernel-janitors, linux-kernel
On 08/03/17 08:59, Peter Rosin wrote:
> On 2017-03-07 16:06, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> Comparing a size_t with less than zero is always false as size_t
>> is unsigned. The intent of the comparison was to check if the size
>> was -1 (that is, undefined), so use that instead.
>>
>> Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
>>
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>
> Hi!
>
> Oops, thanks for highlighting this! However, I think I prefer to instead
> change the type of the struct mux_ext_info_cache member 'size' to ssize_t.
> That way, there is no annoying explicit cast. And perhaps add an early
> check
>
> if (len >= PAGE_SIZE)
> return -EINVAL;
>
> to mux_write_ext_info (because the sysfs read function in use for iio ext
> info can't handle more than a page anyway, IIUC). That way it is fairly
> certain that the ssize_t type will always be big enough. :-)
Sounds like a far better solution.
>
> So, I'm going send out a patch like that instead, unless someone happens to
> beat me to it...
>
> Cheers,
> peda
Thanks,
Colin
>
>> ---
>> drivers/iio/multiplexer/iio-mux.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
>> index 94d40f9b..6c23033 100644
>> --- a/drivers/iio/multiplexer/iio-mux.c
>> +++ b/drivers/iio/multiplexer/iio-mux.c
>> @@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
>>
>> cache = &child->ext_info_cache[i];
>>
>> - if (cache->size < 0)
>> + if (cache->size == (size_t)-1)
>> continue;
>>
>> ret = iio_write_channel_ext_info(mux->parent, attr,
>>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iio: multiplexer: fix unsigned check with less than zero
@ 2017-03-08 9:03 ` Colin Ian King
0 siblings, 0 replies; 9+ messages in thread
From: Colin Ian King @ 2017-03-08 9:03 UTC (permalink / raw)
To: Peter Rosin, Jonathan Cameron, Hartmut Knaack,
Lars-Peter Clausen, Peter Meerwald-Stadler, linux-iio
Cc: kernel-janitors, linux-kernel
On 08/03/17 08:59, Peter Rosin wrote:
> On 2017-03-07 16:06, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> Comparing a size_t with less than zero is always false as size_t
>> is unsigned. The intent of the comparison was to check if the size
>> was -1 (that is, undefined), so use that instead.
>>
>> Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
>>
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>
> Hi!
>
> Oops, thanks for highlighting this! However, I think I prefer to instead
> change the type of the struct mux_ext_info_cache member 'size' to ssize_t.
> That way, there is no annoying explicit cast. And perhaps add an early
> check
>
> if (len >= PAGE_SIZE)
> return -EINVAL;
>
> to mux_write_ext_info (because the sysfs read function in use for iio ext
> info can't handle more than a page anyway, IIUC). That way it is fairly
> certain that the ssize_t type will always be big enough. :-)
Sounds like a far better solution.
>
> So, I'm going send out a patch like that instead, unless someone happens to
> beat me to it...
>
> Cheers,
> peda
Thanks,
Colin
>
>> ---
>> drivers/iio/multiplexer/iio-mux.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
>> index 94d40f9b..6c23033 100644
>> --- a/drivers/iio/multiplexer/iio-mux.c
>> +++ b/drivers/iio/multiplexer/iio-mux.c
>> @@ -61,7 +61,7 @@ static int iio_mux_select(struct mux *mux, int idx)
>>
>> cache = &child->ext_info_cache[i];
>>
>> - if (cache->size < 0)
>> + if (cache->size = (size_t)-1)
>> continue;
>>
>> ret = iio_write_channel_ext_info(mux->parent, attr,
>>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v2] iio: multiplexer: fix unsigned check with less than zero
2017-03-08 9:03 ` Colin Ian King
@ 2017-03-08 13:28 ` Peter Rosin
-1 siblings, 0 replies; 9+ messages in thread
From: Peter Rosin @ 2017-03-08 13:28 UTC (permalink / raw)
To: Colin Ian King
Cc: Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen,
Peter Meerwald-Stadler, linux-iio, kernel-janitors, linux-kernel,
Peter Rosin
Comparing a size_t with less than zero is always false as size_t
is unsigned. So, change the type of the variable to ssize_t and
replicate the size check from mux_configure_channel() into
mux_write_ext_info() thus ensuring that the size will fit in the
ssize_t variable.
Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Peter Rosin <peda@axentia.se>
---
drivers/iio/multiplexer/iio-mux.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Hi!
Here's what intend to queue up.
Cheers,
peda
diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
index 94d40f9b..bab9e69 100644
--- a/drivers/iio/multiplexer/iio-mux.c
+++ b/drivers/iio/multiplexer/iio-mux.c
@@ -21,7 +21,7 @@
struct mux_ext_info_cache {
char *data;
- size_t size;
+ ssize_t size;
};
struct mux_child {
@@ -206,6 +206,9 @@ static ssize_t mux_write_ext_info(struct iio_dev *indio_dev, uintptr_t private,
char *new;
ssize_t ret;
+ if (len >= PAGE_SIZE)
+ return -EINVAL;
+
ret = iio_mux_select(mux, idx);
if (ret < 0)
return ret;
--
2.1.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v2] iio: multiplexer: fix unsigned check with less than zero
@ 2017-03-08 13:28 ` Peter Rosin
0 siblings, 0 replies; 9+ messages in thread
From: Peter Rosin @ 2017-03-08 13:28 UTC (permalink / raw)
To: Colin Ian King
Cc: Jonathan Cameron, Hartmut Knaack, Lars-Peter Clausen,
Peter Meerwald-Stadler, linux-iio, kernel-janitors, linux-kernel,
Peter Rosin
Comparing a size_t with less than zero is always false as size_t
is unsigned. So, change the type of the variable to ssize_t and
replicate the size check from mux_configure_channel() into
mux_write_ext_info() thus ensuring that the size will fit in the
ssize_t variable.
Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Peter Rosin <peda@axentia.se>
---
drivers/iio/multiplexer/iio-mux.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Hi!
Here's what intend to queue up.
Cheers,
peda
diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
index 94d40f9b..bab9e69 100644
--- a/drivers/iio/multiplexer/iio-mux.c
+++ b/drivers/iio/multiplexer/iio-mux.c
@@ -21,7 +21,7 @@
struct mux_ext_info_cache {
char *data;
- size_t size;
+ ssize_t size;
};
struct mux_child {
@@ -206,6 +206,9 @@ static ssize_t mux_write_ext_info(struct iio_dev *indio_dev, uintptr_t private,
char *new;
ssize_t ret;
+ if (len >= PAGE_SIZE)
+ return -EINVAL;
+
ret = iio_mux_select(mux, idx);
if (ret < 0)
return ret;
--
2.1.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH v2] iio: multiplexer: fix unsigned check with less than zero
2017-03-08 13:28 ` Peter Rosin
(?)
@ 2017-03-11 18:30 ` Jonathan Cameron
-1 siblings, 0 replies; 9+ messages in thread
From: Jonathan Cameron @ 2017-03-11 18:30 UTC (permalink / raw)
To: Peter Rosin, Colin Ian King
Cc: Hartmut Knaack, Lars-Peter Clausen, Peter Meerwald-Stadler,
linux-iio, kernel-janitors, linux-kernel
On 08/03/17 13:28, Peter Rosin wrote:
> Comparing a size_t with less than zero is always false as size_t
> is unsigned. So, change the type of the variable to ssize_t and
> replicate the size check from mux_configure_channel() into
> mux_write_ext_info() thus ensuring that the size will fit in the
> ssize_t variable.
>
> Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
>
> Reported-by: Colin Ian King <colin.king@canonical.com>
> Signed-off-by: Peter Rosin <peda@axentia.se>
For what it's worth, looks good to me.
Jonathan
> ---
> drivers/iio/multiplexer/iio-mux.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> Hi!
>
> Here's what intend to queue up.
>
> Cheers,
> peda
>
> diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
> index 94d40f9b..bab9e69 100644
> --- a/drivers/iio/multiplexer/iio-mux.c
> +++ b/drivers/iio/multiplexer/iio-mux.c
> @@ -21,7 +21,7 @@
>
> struct mux_ext_info_cache {
> char *data;
> - size_t size;
> + ssize_t size;
> };
>
> struct mux_child {
> @@ -206,6 +206,9 @@ static ssize_t mux_write_ext_info(struct iio_dev *indio_dev, uintptr_t private,
> char *new;
> ssize_t ret;
>
> + if (len >= PAGE_SIZE)
> + return -EINVAL;
> +
> ret = iio_mux_select(mux, idx);
> if (ret < 0)
> return ret;
>
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2017-03-11 18:30 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-07 15:06 [PATCH] iio: multiplexer: fix unsigned check with less than zero Colin King
2017-03-07 15:06 ` Colin King
2017-03-08 8:59 ` Peter Rosin
2017-03-08 8:59 ` Peter Rosin
2017-03-08 9:03 ` Colin Ian King
2017-03-08 9:03 ` Colin Ian King
2017-03-08 13:28 ` [PATCH v2] " Peter Rosin
2017-03-08 13:28 ` Peter Rosin
2017-03-11 18:30 ` Jonathan Cameron
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.