[v2] iio: gp2ap020a00f: Fix signedness bug

[PATCH V2] iio: gp2ap020a00f: Fix signedness bug

Posted by Haowen Bai 4 years ago

function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL 
errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so 
we have to change u8 -> int.

Signed-off-by: Haowen Bai <baihaowen@meizu.com>
---
V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
side we need to use int

 drivers/iio/light/gp2ap020a00f.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
index b820041159f7..b0e62d3c6fa0 100644
--- a/drivers/iio/light/gp2ap020a00f.c
+++ b/drivers/iio/light/gp2ap020a00f.c
@@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
 	return IRQ_HANDLED;
 }
 
-static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
+static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
 					     enum iio_event_direction event_dir)
 {
 	switch (chan->type) {
@@ -1025,7 +1025,7 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
 	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
 	bool event_en = false;
 	u8 thresh_val_id;
-	u8 thresh_reg_l;
+	int thresh_reg_l;
 	int err = 0;
 
 	mutex_lock(&data->lock);
@@ -1082,7 +1082,7 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
 				       int *val, int *val2)
 {
 	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
-	u8 thresh_reg_l;
+	int thresh_reg_l;
 	int err = IIO_VAL_INT;
 
 	mutex_lock(&data->lock);
-- 
2.7.4

Re: [PATCH V2] iio: gp2ap020a00f: Fix signedness bug

Posted by Jonathan Cameron 4 years ago

On Fri, 15 Apr 2022 09:20:37 +0800
Haowen Bai <baihaowen@meizu.com> wrote:

> function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL 
> errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so 
> we have to change u8 -> int.
> 
> Signed-off-by: Haowen Bai <baihaowen@meizu.com>
Hi,

The return value is not checked in *read_event_val(), so if we actually got
-EINVAL (in reality we can't because the switch in *_get_thresh_reg*) always
matches) then we'd use it to index an array (after performing some maths on
the value).  So please also add a check that the return value is not
negative in read_event_val()

Same is true or write_event_val.


Note that the bug here is probably the fact we return -EINVAL in the
first place. We could just stop doing that but it would be non obvious
when looking at the code that we couldn't get a failure to match in
the switch statement - so fixing as you have done (plus the extra
check I'm requesting) is probably the neatest solution.

Thanks,

Jonathan


> ---
> V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
> side we need to use int
> 
>  drivers/iio/light/gp2ap020a00f.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
> index b820041159f7..b0e62d3c6fa0 100644
> --- a/drivers/iio/light/gp2ap020a00f.c
> +++ b/drivers/iio/light/gp2ap020a00f.c
> @@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
>  	return IRQ_HANDLED;
>  }
>  
> -static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
> +static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
>  					     enum iio_event_direction event_dir)
>  {
>  	switch (chan->type) {
> @@ -1025,7 +1025,7 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
>  	bool event_en = false;
>  	u8 thresh_val_id;
> -	u8 thresh_reg_l;
> +	int thresh_reg_l;
>  	int err = 0;
>  
>  	mutex_lock(&data->lock);
> @@ -1082,7 +1082,7 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
>  				       int *val, int *val2)
>  {
>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
> -	u8 thresh_reg_l;
> +	int thresh_reg_l;
>  	int err = IIO_VAL_INT;
>  
>  	mutex_lock(&data->lock);

Re: [PATCH V2] iio: gp2ap020a00f: Fix signedness bug

Posted by baihaowen 4 years ago

在 4/16/22 1:52 AM, Jonathan Cameron 写道:
> On Fri, 15 Apr 2022 09:20:37 +0800
> Haowen Bai <baihaowen@meizu.com> wrote:
>
>> function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL 
>> errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so 
>> we have to change u8 -> int.
>>
>> Signed-off-by: Haowen Bai <baihaowen@meizu.com>
> Hi,
>
> The return value is not checked in *read_event_val(), so if we actually got
> -EINVAL (in reality we can't because the switch in *_get_thresh_reg*) always
> matches) then we'd use it to index an array (after performing some maths on
> the value).  So please also add a check that the return value is not
> negative in read_event_val()
>
> Same is true or write_event_val.
>
>
> Note that the bug here is probably the fact we return -EINVAL in the
> first place. We could just stop doing that but it would be non obvious
> when looking at the code that we couldn't get a failure to match in
> the switch statement - so fixing as you have done (plus the extra
> check I'm requesting) is probably the neatest solution.
>
> Thanks,
>
> Jonathan
>
>
>> ---
>> V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
>> side we need to use int
>>
>>  drivers/iio/light/gp2ap020a00f.c | 6 +++---
>>  1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
>> index b820041159f7..b0e62d3c6fa0 100644
>> --- a/drivers/iio/light/gp2ap020a00f.c
>> +++ b/drivers/iio/light/gp2ap020a00f.c
>> @@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
>>  	return IRQ_HANDLED;
>>  }
>>  
>> -static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
>> +static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
>>  					     enum iio_event_direction event_dir)
>>  {
>>  	switch (chan->type) {
>> @@ -1025,7 +1025,7 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
>>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
>>  	bool event_en = false;
>>  	u8 thresh_val_id;
>> -	u8 thresh_reg_l;
>> +	int thresh_reg_l;
>>  	int err = 0;
>>  
>>  	mutex_lock(&data->lock);
>> @@ -1082,7 +1082,7 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
>>  				       int *val, int *val2)
>>  {
>>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
>> -	u8 thresh_reg_l;
>> +	int thresh_reg_l;
>>  	int err = IIO_VAL_INT;
>>  
>>  	mutex_lock(&data->lock);
hi Jonathan Cameron

Thank you for your suggestion. resended :).

-- 
Haowen Bai

[PATCH V3] iio: gp2ap020a00f: Fix signedness bug

Posted by Haowen Bai 4 years ago

function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL
errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so
we have to change u8 -> int. Also we need to do index bound check at
gp2ap020a00f_read_event_val().

Signed-off-by: Haowen Bai <baihaowen@meizu.com>
---
V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
side we need to use int.
V2->V3: add bound check at gp2ap020a00f_read_event_val().


 drivers/iio/light/gp2ap020a00f.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
index b820041159f7..f80d30786035 100644
--- a/drivers/iio/light/gp2ap020a00f.c
+++ b/drivers/iio/light/gp2ap020a00f.c
@@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
 	return IRQ_HANDLED;
 }
 
-static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
+static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
 					     enum iio_event_direction event_dir)
 {
 	switch (chan->type) {
@@ -1025,7 +1025,7 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
 	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
 	bool event_en = false;
 	u8 thresh_val_id;
-	u8 thresh_reg_l;
+	int thresh_reg_l;
 	int err = 0;
 
 	mutex_lock(&data->lock);
@@ -1082,14 +1082,14 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
 				       int *val, int *val2)
 {
 	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
-	u8 thresh_reg_l;
+	int thresh_reg_l;
 	int err = IIO_VAL_INT;
 
 	mutex_lock(&data->lock);
 
 	thresh_reg_l = gp2ap020a00f_get_thresh_reg(chan, dir);
 
-	if (thresh_reg_l > GP2AP020A00F_PH_L_REG) {
+	if (thresh_reg_l < 0 || thresh_reg_l > GP2AP020A00F_PH_L_REG) {
 		err = -EINVAL;
 		goto error_unlock;
 	}
-- 
2.7.4

Re: [PATCH V3] iio: gp2ap020a00f: Fix signedness bug

Posted by Jonathan Cameron 4 years ago

On Mon, 18 Apr 2022 10:19:35 +0800
Haowen Bai <baihaowen@meizu.com> wrote:

> function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL
> errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so
> we have to change u8 -> int. Also we need to do index bound check at
> gp2ap020a00f_read_event_val().
> 
> Signed-off-by: Haowen Bai <baihaowen@meizu.com>

Please add a Fixes tag if possible.

> ---
> V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
> side we need to use int.
> V2->V3: add bound check at gp2ap020a00f_read_event_val().
> 
> 
>  drivers/iio/light/gp2ap020a00f.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
> index b820041159f7..f80d30786035 100644
> --- a/drivers/iio/light/gp2ap020a00f.c
> +++ b/drivers/iio/light/gp2ap020a00f.c
> @@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
>  	return IRQ_HANDLED;
>  }
>  
> -static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
> +static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
>  					     enum iio_event_direction event_dir)
>  {
>  	switch (chan->type) {
> @@ -1025,7 +1025,7 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
>  	bool event_en = false;
>  	u8 thresh_val_id;
> -	u8 thresh_reg_l;
> +	int thresh_reg_l;

You need to check this val after the function call, but before it is used.


>  	int err = 0;
>  
>  	mutex_lock(&data->lock);
> @@ -1082,14 +1082,14 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
>  				       int *val, int *val2)
>  {
>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
> -	u8 thresh_reg_l;
> +	int thresh_reg_l;
>  	int err = IIO_VAL_INT;
>  
>  	mutex_lock(&data->lock);
>  
>  	thresh_reg_l = gp2ap020a00f_get_thresh_reg(chan, dir);
>  
> -	if (thresh_reg_l > GP2AP020A00F_PH_L_REG) {
> +	if (thresh_reg_l < 0 || thresh_reg_l > GP2AP020A00F_PH_L_REG) {
>  		err = -EINVAL;
If a function returns an error we should pass that on unchanged 
Here the value is the same, but none the less we should have this look something
like.

	if (thresh_reg_l < 0)
		return thresh_reg_l;
	if (thresh_reg_l > GP2AP020A00F_PH_L_REG)
	...

>  		goto error_unlock;
>  	}

[PATCH V4] iio: gp2ap020a00f: Fix signedness bug

Posted by Haowen Bai 4 years ago

function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL
errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so
we have to change u8 -> int. Also we need to do index bound check at
gp2ap020a00f_read_event_val().

Signed-off-by: Haowen Bai <baihaowen@meizu.com>
---
V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
side we need to use int.
V2->V3: add bound check at gp2ap020a00f_read_event_val().
V3->V4: 
1. add fix tag.
2. add check before use at gp2ap020a00f_write_event_val().
3. returns an error we should pass that on unchanged at
gp2ap020a00f_read_event_val()

 drivers/iio/light/gp2ap020a00f.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
index b820041159f7..13583e1191d4 100644
--- a/drivers/iio/light/gp2ap020a00f.c
+++ b/drivers/iio/light/gp2ap020a00f.c
@@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
 	return IRQ_HANDLED;
 }
 
-static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
+static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
 					     enum iio_event_direction event_dir)
 {
 	switch (chan->type) {
@@ -1025,12 +1025,18 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
 	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
 	bool event_en = false;
 	u8 thresh_val_id;
-	u8 thresh_reg_l;
+	int thresh_reg_l;
 	int err = 0;
 
 	mutex_lock(&data->lock);
 
 	thresh_reg_l = gp2ap020a00f_get_thresh_reg(chan, dir);
+
+	if (thresh_reg_l < 0){
+		err = thresh_reg_l;
+		goto error_unlock;
+	}
+
 	thresh_val_id = GP2AP020A00F_THRESH_VAL_ID(thresh_reg_l);
 
 	if (thresh_val_id > GP2AP020A00F_THRESH_PH) {
@@ -1082,13 +1088,16 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
 				       int *val, int *val2)
 {
 	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
-	u8 thresh_reg_l;
+	int thresh_reg_l;
 	int err = IIO_VAL_INT;
 
 	mutex_lock(&data->lock);
 
 	thresh_reg_l = gp2ap020a00f_get_thresh_reg(chan, dir);
 
+	if (thresh_reg_l < 0)
+		return thresh_reg_l;
+
 	if (thresh_reg_l > GP2AP020A00F_PH_L_REG) {
 		err = -EINVAL;
 		goto error_unlock;
-- 
2.7.4

Re: [PATCH V4] iio: gp2ap020a00f: Fix signedness bug

Posted by Jonathan Cameron 4 years ago

On Fri, 29 Apr 2022 09:36:54 +0800
Haowen Bai <baihaowen@meizu.com> wrote:

> function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL
> errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so
> we have to change u8 -> int. Also we need to do index bound check at
> gp2ap020a00f_read_event_val().
> 
> Signed-off-by: Haowen Bai <baihaowen@meizu.com>
Hi Haowen Bai,

Please add a fixes tag.  Also, this thread is getting rather deep
and illustrates why I tend to ask for each new version of IIO patches
to be posted without replying to previous thread (so start a new thread).

One issue below with locking.

Thanks,

Jonathan

> ---
> V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
> side we need to use int.
> V2->V3: add bound check at gp2ap020a00f_read_event_val().
> V3->V4: 
> 1. add fix tag.
> 2. add check before use at gp2ap020a00f_write_event_val().
> 3. returns an error we should pass that on unchanged at
> gp2ap020a00f_read_event_val()
> 
>  drivers/iio/light/gp2ap020a00f.c | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
> index b820041159f7..13583e1191d4 100644
> --- a/drivers/iio/light/gp2ap020a00f.c
> +++ b/drivers/iio/light/gp2ap020a00f.c
> @@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
>  	return IRQ_HANDLED;
>  }
>  
> -static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
> +static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
>  					     enum iio_event_direction event_dir)
>  {
>  	switch (chan->type) {
> @@ -1025,12 +1025,18 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
>  	bool event_en = false;
>  	u8 thresh_val_id;
> -	u8 thresh_reg_l;
> +	int thresh_reg_l;
>  	int err = 0;
>  
>  	mutex_lock(&data->lock);
>  
>  	thresh_reg_l = gp2ap020a00f_get_thresh_reg(chan, dir);
> +
> +	if (thresh_reg_l < 0){
> +		err = thresh_reg_l;
> +		goto error_unlock;
> +	}
> +
>  	thresh_val_id = GP2AP020A00F_THRESH_VAL_ID(thresh_reg_l);
>  
>  	if (thresh_val_id > GP2AP020A00F_THRESH_PH) {
> @@ -1082,13 +1088,16 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
>  				       int *val, int *val2)
>  {
>  	struct gp2ap020a00f_data *data = iio_priv(indio_dev);
> -	u8 thresh_reg_l;
> +	int thresh_reg_l;
>  	int err = IIO_VAL_INT;
>  
>  	mutex_lock(&data->lock);
>  
>  	thresh_reg_l = gp2ap020a00f_get_thresh_reg(chan, dir);
>  
> +	if (thresh_reg_l < 0)
mutex_unlock() ?

I'd expect something like
	if (thresh_reg_l < 0) {
		err = thresh_reg_l;
		goto error_unlock;
	}

> +		return thresh_reg_l;
> +
>  	if (thresh_reg_l > GP2AP020A00F_PH_L_REG) {
>  		err = -EINVAL;
>  		goto error_unlock;