On Mon, 18 Apr 2022 10:19:35 +0800
Haowen Bai <baihaowen@xxxxxxxxx> wrote:
> function gp2ap020a00f_get_thresh_reg() is unsigned but returning -EINVAL
> errcode, and thresh_reg_l is unsigned but receiving -EINVAL errcode. so
> we have to change u8 -> int. Also we need to do index bound check at
> gp2ap020a00f_read_event_val().
>
> Signed-off-by: Haowen Bai <baihaowen@xxxxxxxxx>
Please add a Fixes tag if possible.
> ---
> V1->V2: s8 is not enough to hold an (arbitrary) error code. To be on the safe
> side we need to use int.
> V2->V3: add bound check at gp2ap020a00f_read_event_val().
>
>
> drivers/iio/light/gp2ap020a00f.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/iio/light/gp2ap020a00f.c b/drivers/iio/light/gp2ap020a00f.c
> index b820041159f7..f80d30786035 100644
> --- a/drivers/iio/light/gp2ap020a00f.c
> +++ b/drivers/iio/light/gp2ap020a00f.c
> @@ -994,7 +994,7 @@ static irqreturn_t gp2ap020a00f_trigger_handler(int irq, void *data)
> return IRQ_HANDLED;
> }
>
> -static u8 gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
> +static int gp2ap020a00f_get_thresh_reg(const struct iio_chan_spec *chan,
> enum iio_event_direction event_dir)
> {
> switch (chan->type) {
> @@ -1025,7 +1025,7 @@ static int gp2ap020a00f_write_event_val(struct iio_dev *indio_dev,
> struct gp2ap020a00f_data *data = iio_priv(indio_dev);
> bool event_en = false;
> u8 thresh_val_id;
> - u8 thresh_reg_l;
> + int thresh_reg_l;
You need to check this val after the function call, but before it is used.
> int err = 0;
>
> mutex_lock(&data->lock);
> @@ -1082,14 +1082,14 @@ static int gp2ap020a00f_read_event_val(struct iio_dev *indio_dev,
> int *val, int *val2)
> {
> struct gp2ap020a00f_data *data = iio_priv(indio_dev);
> - u8 thresh_reg_l;
> + int thresh_reg_l;
> int err = IIO_VAL_INT;
>
> mutex_lock(&data->lock);
>
> thresh_reg_l = gp2ap020a00f_get_thresh_reg(chan, dir);
>
> - if (thresh_reg_l > GP2AP020A00F_PH_L_REG) {
> + if (thresh_reg_l < 0 || thresh_reg_l > GP2AP020A00F_PH_L_REG) {
> err = -EINVAL;
If a function returns an error we should pass that on unchanged
Here the value is the same, but none the less we should have this look something
like.
if (thresh_reg_l < 0)
return thresh_reg_l;
if (thresh_reg_l > GP2AP020A00F_PH_L_REG)
...
> goto error_unlock;
> }
