| Message ID | 72e77a25-fe33-b88e-bfe2-654e10281fba@cogentembedded.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Ambarus Tudor |
| Headers | show |
| Series | mtd: spi-nor: fix silent truncation in spi_nor_read() | expand |
Hi Sergei, On 16/10/19 1:53 AM, Sergei Shtylyov wrote: > spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to > an 'int ret' variable, where the silent truncation isn't really valid -- > ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines. > Good catch! Curious to know if you did observe any real issue because of this bug? Regards Vignesh > Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write") > Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> > > --- > This patch is against of the 'mtd/fixes' branch of the MTD 'linux.git' repo. > > drivers/mtd/spi-nor/spi-nor.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > Index: linux/drivers/mtd/spi-nor/spi-nor.c > =================================================================== > --- linux.orig/drivers/mtd/spi-nor/spi-nor.c > +++ linux/drivers/mtd/spi-nor/spi-nor.c > @@ -2544,7 +2544,7 @@ static int spi_nor_read(struct mtd_info > size_t *retlen, u_char *buf) > { > struct spi_nor *nor = mtd_to_spi_nor(mtd); > - int ret; > + ssize_t ret; > > dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len); > >
Hello! On 16.10.2019 8:18, Vignesh Raghavendra wrote: >> spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to >> an 'int ret' variable, where the silent truncation isn't really valid -- >> ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines. >> > > Good catch! Curious to know if you did observe any real issue because of > this bug? No, found it just looking at the code. > Regards > Vignesh > >> Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write") >> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> [...] MBR, Sergei
On 10/16/2019 08:18 AM, Vignesh Raghavendra wrote: >> spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to >> an 'int ret' variable, where the silent truncation isn't really valid -- >> ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines. >> > > Good catch! Curious to know if you did observe any real issue because of > this bug? I think I need to rewrite the description in a more clear way, so don't apply this as yet, please. MBR, Sergei
Index: linux/drivers/mtd/spi-nor/spi-nor.c =================================================================== --- linux.orig/drivers/mtd/spi-nor/spi-nor.c +++ linux/drivers/mtd/spi-nor/spi-nor.c @@ -2544,7 +2544,7 @@ static int spi_nor_read(struct mtd_info size_t *retlen, u_char *buf) { struct spi_nor *nor = mtd_to_spi_nor(mtd); - int ret; + ssize_t ret; dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len);
spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to an 'int ret' variable, where the silent truncation isn't really valid -- ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines. Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write") Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> --- This patch is against of the 'mtd/fixes' branch of the MTD 'linux.git' repo. drivers/mtd/spi-nor/spi-nor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)