| Message ID | a4af764e-990b-4ebd-b342-852844374032@moroto.mountain (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Headers | show |
| Series | platform/mellanox: mlxbf-pmc: fix signedness bugs | expand |
On Thu, 29 Feb 2024 16:11:36 +0300, Dan Carpenter wrote: > These need to be signed for the error handling to work. The > mlxbf_pmc_get_event_num() function returns int so int type is correct. > > Thank you for your contribution, it has been applied to my local review-ilpo branch. Note it will show up in the public platform-drivers-x86/review-ilpo branch only once I've pushed my local branch there, which might take a while. The list of commits applied: [1/1] platform/mellanox: mlxbf-pmc: fix signedness bugs commit: d22168db08c4c8e6c5e25fa3570f50f0f2ff1ef1 -- i.
On Thu, 29 Feb 2024, Dan Carpenter wrote: > These need to be signed for the error handling to work. The > mlxbf_pmc_get_event_num() function returns int so int type is correct. > > Fixes: 1ae9ffd303c2 ("platform/mellanox: mlxbf-pmc: Cleanup signed/unsigned mix-up") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > The code in mlxbf_pmc_valid_range() has a check for negatives but that > has a signedness bug too. Fortunately "(u32)-EINVAL + 8" will not > result in an integer overflow so the offset is treated as invalid. Hi, While this patch itself was fine so I applied it, when reviewing the patch I noticed that some of the kstrtouint() derived values were not properly bound checked (some were fed directly to FIELD_PREP()).
diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c index 250405bb59a7..bc91423c96b9 100644 --- a/drivers/platform/mellanox/mlxbf-pmc.c +++ b/drivers/platform/mellanox/mlxbf-pmc.c @@ -1496,8 +1496,9 @@ static ssize_t mlxbf_pmc_counter_show(struct device *dev, { struct mlxbf_pmc_attribute *attr_counter = container_of( attr, struct mlxbf_pmc_attribute, dev_attr); - unsigned int blk_num, cnt_num, offset; + unsigned int blk_num, cnt_num; bool is_l3 = false; + int offset; u64 value; blk_num = attr_counter->nr; @@ -1530,9 +1531,10 @@ static ssize_t mlxbf_pmc_counter_store(struct device *dev, { struct mlxbf_pmc_attribute *attr_counter = container_of( attr, struct mlxbf_pmc_attribute, dev_attr); - unsigned int blk_num, cnt_num, offset, data; + unsigned int blk_num, cnt_num, data; bool is_l3 = false; u64 evt_num; + int offset; int err; blk_num = attr_counter->nr; @@ -1612,8 +1614,9 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev, { struct mlxbf_pmc_attribute *attr_event = container_of( attr, struct mlxbf_pmc_attribute, dev_attr); - unsigned int blk_num, cnt_num, evt_num; + unsigned int blk_num, cnt_num; bool is_l3 = false; + int evt_num; int err; blk_num = attr_event->nr;
These need to be signed for the error handling to work. The mlxbf_pmc_get_event_num() function returns int so int type is correct. Fixes: 1ae9ffd303c2 ("platform/mellanox: mlxbf-pmc: Cleanup signed/unsigned mix-up") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- The code in mlxbf_pmc_valid_range() has a check for negatives but that has a signedness bug too. Fortunately "(u32)-EINVAL + 8" will not result in an integer overflow so the offset is treated as invalid. drivers/platform/mellanox/mlxbf-pmc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)