From: Dan Carpenter <dan.carpenter@oracle.com> To: Boris Brezillon <bbrezillon@kernel.org> Cc: linux-i3c@lists.infradead.org, kernel-janitors@vger.kernel.org Subject: [PATCH] i3c: Fix a shift wrap bug in i3c_bus_set_addr_slot_status() Date: Tue, 23 Apr 2019 10:40:20 +0000 [thread overview] Message-ID: <20190423104020.GA3133@mwanda> (raw) The problem here is that addr can be I3C_BROADCAST_ADDR (126). That means we're shifting by (126 * 2) % 64 which is 60. The I3C_ADDR_SLOT_STATUS_MASK is an enum which is an unsigned int in GCC so shifts greater than 31 are undefined. Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- This patch is from static analysis. I really know what *ptr is used for and I haven't tested the code. The other question is would be testing this code on 32 bit systems. Please review carefully. drivers/i3c/master.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 1412abcff010..5f4bd52121fe 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -385,8 +385,9 @@ static void i3c_bus_set_addr_slot_status(struct i3c_bus *bus, u16 addr, return; ptr = bus->addrslots + (bitpos / BITS_PER_LONG); - *ptr &= ~(I3C_ADDR_SLOT_STATUS_MASK << (bitpos % BITS_PER_LONG)); - *ptr |= status << (bitpos % BITS_PER_LONG); + *ptr &= ~((unsigned long)I3C_ADDR_SLOT_STATUS_MASK << + (bitpos % BITS_PER_LONG)); + *ptr |= (unsigned long)status << (bitpos % BITS_PER_LONG); } static bool i3c_bus_dev_addr_is_avail(struct i3c_bus *bus, u8 addr) -- 2.18.0
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com> To: Boris Brezillon <bbrezillon@kernel.org> Cc: linux-i3c@lists.infradead.org, kernel-janitors@vger.kernel.org Subject: [PATCH] i3c: Fix a shift wrap bug in i3c_bus_set_addr_slot_status() Date: Tue, 23 Apr 2019 13:40:20 +0300 [thread overview] Message-ID: <20190423104020.GA3133@mwanda> (raw) The problem here is that addr can be I3C_BROADCAST_ADDR (126). That means we're shifting by (126 * 2) % 64 which is 60. The I3C_ADDR_SLOT_STATUS_MASK is an enum which is an unsigned int in GCC so shifts greater than 31 are undefined. Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- This patch is from static analysis. I really know what *ptr is used for and I haven't tested the code. The other question is would be testing this code on 32 bit systems. Please review carefully. drivers/i3c/master.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 1412abcff010..5f4bd52121fe 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -385,8 +385,9 @@ static void i3c_bus_set_addr_slot_status(struct i3c_bus *bus, u16 addr, return; ptr = bus->addrslots + (bitpos / BITS_PER_LONG); - *ptr &= ~(I3C_ADDR_SLOT_STATUS_MASK << (bitpos % BITS_PER_LONG)); - *ptr |= status << (bitpos % BITS_PER_LONG); + *ptr &= ~((unsigned long)I3C_ADDR_SLOT_STATUS_MASK << + (bitpos % BITS_PER_LONG)); + *ptr |= (unsigned long)status << (bitpos % BITS_PER_LONG); } static bool i3c_bus_dev_addr_is_avail(struct i3c_bus *bus, u8 addr) -- 2.18.0 _______________________________________________ linux-i3c mailing list linux-i3c@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-i3c
next reply other threads:[~2019-04-23 10:40 UTC|newest] Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-04-23 10:40 Dan Carpenter [this message] 2019-04-23 10:40 ` [PATCH] i3c: Fix a shift wrap bug in i3c_bus_set_addr_slot_status() Dan Carpenter
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190423104020.GA3133@mwanda \ --to=dan.carpenter@oracle.com \ --cc=bbrezillon@kernel.org \ --cc=kernel-janitors@vger.kernel.org \ --cc=linux-i3c@lists.infradead.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.