iio: sca3000: Potential endian bug in sca3000_read_event_value()
Subsystems (2)
PATCH 1/1 iio: sca3000: Potential endian bug in sca3000_read_event_value()
The problem is that "ret" is an int but we're casting it as "(unsigned long *)&ret" when we do the for_each_set_bit() loop. This will not work on big endian 64 bit systems.
Signed-off-by Dan Carpenter <[email protected]>
--- drivers/iio/accel/sca3000.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/iio/accel/sca3000.c +4 -3
@@ -872,8 +872,9 @@ static int sca3000_read_event_value(struct iio_dev *indio_dev,enum iio_event_info info, int *val, int *val2) { - int ret, i; struct sca3000_state *st = iio_priv(indio_dev); +long ret; +int i;switch (info) {case IIO_EV_INFO_VALUE :
@@ -885,11 +886,11 @@ static int sca3000_read_event_value(struct iio_dev *indio_dev,return ret; *val =0 ;if (chan->channel2 =IIO_MOD_Y ) -for_each_set_bit (i, (unsigned long *)&ret, +for_each_set_bit (i, &ret,ARRAY_SIZE (st->info->mot_det_mult_y)) *val += st->info->mot_det_mult_y[i];else -for_each_set_bit (i, (unsigned long *)&ret, +for_each_set_bit (i, &ret,ARRAY_SIZE (st->info->mot_det_mult_xz)) *val += st->info->mot_det_mult_xz[i];
Signature · 1 line
2.20.1
Jonathan Cameron
maintainerQuoted 5 lines · On Fri, 21 Jun 2019 12:18:28 +0300 Dan Carpenter <[email protected]>…
The problem is that "ret" is an int but we're casting it as "(unsigned long *)&ret" when we do the
for_each_set_bit()loop. This will not work on big endian 64 bit systems.Signed-off-by Dan Carpenter <[email protected]>
Hi Dan,
Great catch, I've applied this to the togreg branch of iio.git (rather than fixes) given the point in the cycle and limited chance anyone is actually running this obsolete part on a be64 machine. I would love to be proved wrong though and would be happy to push this for stable if we do get any reports!
Thanks,
Jonathan
Quoted 33 lines
--- drivers/iio/accel/sca3000.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)drivers/iio/accel/sca3000.c +4
-3@@ -872,8 +872,9 @@ static int sca3000_read_event_value(struct iio_dev *indio_dev,enum iio_event_info info, int *val, int *val2) { - int ret, i; struct sca3000_state *st = iio_priv(indio_dev); +long ret; +int i;switch (info) {case IIO_EV_INFO_VALUE :@@ -885,11 +886,11 @@ static int sca3000_read_event_value(struct iio_dev *indio_dev,return ret; *val =0 ;if (chan->channel2 =IIO_MOD_Y ) -for_each_set_bit (i, (unsigned long *)&ret, +for_each_set_bit (i, &ret,ARRAY_SIZE (st->info->mot_det_mult_y)) *val += st->info->mot_det_mult_y[i];else -for_each_set_bit (i, (unsigned long *)&ret, +for_each_set_bit (i, &ret,ARRAY_SIZE (st->info->mot_det_mult_xz)) *val += st->info->mot_det_mult_xz[i];