mtd: spi-nor: fix silent truncation in spi_nor_read()
diff mbox series

Message ID 72e77a25-fe33-b88e-bfe2-654e10281fba@cogentembedded.com
State Changes Requested
Delegated to: Ambarus Tudor
Headers show
Series
  • mtd: spi-nor: fix silent truncation in spi_nor_read()
Related show

Commit Message

Sergei Shtylyov Oct. 15, 2019, 8:23 p.m. UTC
spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to
an 'int ret' variable, where the silent truncation isn't really valid --
ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines.

Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>

---
This patch is against of the 'mtd/fixes' branch of the MTD 'linux.git' repo.

 drivers/mtd/spi-nor/spi-nor.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Vignesh Raghavendra Oct. 16, 2019, 5:18 a.m. UTC | #1
Hi Sergei,

On 16/10/19 1:53 AM, Sergei Shtylyov wrote:
> spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to
> an 'int ret' variable, where the silent truncation isn't really valid --
> ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines.
> 

Good catch! Curious to know if you did observe any real issue because of
this bug?

Regards
Vignesh

> Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write")
> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> 
> ---
> This patch is against of the 'mtd/fixes' branch of the MTD 'linux.git' repo.
> 
>  drivers/mtd/spi-nor/spi-nor.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: linux/drivers/mtd/spi-nor/spi-nor.c
> ===================================================================
> --- linux.orig/drivers/mtd/spi-nor/spi-nor.c
> +++ linux/drivers/mtd/spi-nor/spi-nor.c
> @@ -2544,7 +2544,7 @@ static int spi_nor_read(struct mtd_info
>  			size_t *retlen, u_char *buf)
>  {
>  	struct spi_nor *nor = mtd_to_spi_nor(mtd);
> -	int ret;
> +	ssize_t ret;
>  
>  	dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len);
>  
>
Sergei Shtylyov Oct. 16, 2019, 9:30 a.m. UTC | #2
Hello!

On 16.10.2019 8:18, Vignesh Raghavendra wrote:

>> spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to
>> an 'int ret' variable, where the silent truncation isn't really valid --
>> ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines.
>>
> 
> Good catch! Curious to know if you did observe any real issue because of
> this bug?

    No, found it just looking at the code.

> Regards
> Vignesh
> 
>> Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write")
>> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>

[...]

MBR, Sergei
Sergei Shtylyov Oct. 16, 2019, 6:49 p.m. UTC | #3
On 10/16/2019 08:18 AM, Vignesh Raghavendra wrote:

>> spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to
>> an 'int ret' variable, where the silent truncation isn't really valid --
>> ssize_t is a 64-bit type and *int* is a 32-bit type on 64-bit machines.
>>
> 
> Good catch! Curious to know if you did observe any real issue because of
> this bug?

   I think I need to rewrite the description in a more clear way, so don't
apply this as yet, please.

MBR, Sergei

Patch
diff mbox series

Index: linux/drivers/mtd/spi-nor/spi-nor.c
===================================================================
--- linux.orig/drivers/mtd/spi-nor/spi-nor.c
+++ linux/drivers/mtd/spi-nor/spi-nor.c
@@ -2544,7 +2544,7 @@  static int spi_nor_read(struct mtd_info
 			size_t *retlen, u_char *buf)
 {
 	struct spi_nor *nor = mtd_to_spi_nor(mtd);
-	int ret;
+	ssize_t ret;
 
 	dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len);