Commit 1d530277 authored by Dan Carpenter's avatar Dan Carpenter Committed by Zheng Zengkai
Browse files

firmware: arm_scpi: Prevent the ternary sign expansion bug

stable inclusion
from stable-5.10.40
commit 4dcb3aa4a5ad6f9f89a8ad34df8dc39c77e87c1e
bugzilla: 51882
CVE: NA

--------------------------------

[ Upstream commit d9cd78ed ]

How the type promotion works in ternary expressions is a bit tricky.
The problem is that scpi_clk_get_val() returns longs, "ret" is a int
which holds a negative error code, and le32_to_cpu() is an unsigned int.
We want the negative error code to be cast to a negative long.  But
because le32_to_cpu() is an u32 then "ret" is type promoted to u32 and
becomes a high positive and then it is promoted to long and it is still
a high positive value.

Fix this by getting rid of the ternary.

Link: https://lore.kernel.org/r/YIE7pdqV/h10tEAK@mwanda


Fixes: 8cb7cf56 ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol")
Reviewed-by: default avatarCristian Marussi <cristian.marussi@arm.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
[sudeep.holla: changed to return 0 as clock rate on error]
Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>

Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent f7c8e28f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment