| Message ID | 20210930122803.GC10068@kili (mailing list archive) |
|---|---|
| State | Mainlined, archived |
| Headers | show |
| Series | thermal: int340x: delete bogus length check | expand |
On Thu, Sep 30, 2021 at 2:28 PM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > This check has a signedness bug and does not work. If "length" is > larger than "PAGE_SIZE" then "PAGE_SIZE - length" is not negative > but instead it is a large unsigned value. Fortunately, Takashi Iwai > changed this code to use scnprint() instead of snprintf() so now > "length" is never larger than "PAGE_SIZE - 1" and the check can be > removed. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 9 ++++----- > 1 file changed, 4 insertions(+), 5 deletions(-) > > diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c > index 19926beeb3b7..8502b7d8df89 100644 > --- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c > +++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c > @@ -129,11 +129,10 @@ static ssize_t available_uuids_show(struct device *dev, > > for (i = 0; i < INT3400_THERMAL_MAXIMUM_UUID; i++) { > if (priv->uuid_bitmap & (1 << i)) > - if (PAGE_SIZE - length > 0) > - length += scnprintf(&buf[length], > - PAGE_SIZE - length, > - "%s\n", > - int3400_thermal_uuids[i]); > + length += scnprintf(&buf[length], > + PAGE_SIZE - length, > + "%s\n", > + int3400_thermal_uuids[i]); > } > > return length; > -- Applied as 5.16 material, thanks!
diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c index 19926beeb3b7..8502b7d8df89 100644 --- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c @@ -129,11 +129,10 @@ static ssize_t available_uuids_show(struct device *dev, for (i = 0; i < INT3400_THERMAL_MAXIMUM_UUID; i++) { if (priv->uuid_bitmap & (1 << i)) - if (PAGE_SIZE - length > 0) - length += scnprintf(&buf[length], - PAGE_SIZE - length, - "%s\n", - int3400_thermal_uuids[i]); + length += scnprintf(&buf[length], + PAGE_SIZE - length, + "%s\n", + int3400_thermal_uuids[i]); } return length;
This check has a signedness bug and does not work. If "length" is larger than "PAGE_SIZE" then "PAGE_SIZE - length" is not negative but instead it is a large unsigned value. Fortunately, Takashi Iwai changed this code to use scnprint() instead of snprintf() so now "length" is never larger than "PAGE_SIZE - 1" and the check can be removed. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)