Re: [PATCH] btusb: fix overflow return values

[Adam Lee]

On Mon, Jul 08, 2013 at 11:50:54AM -0700, Marcel Holtmann wrote:
> Hi Adam,
> 
> > PTR_ERR() returns a long type value, but btusb_setup_intel() and
> > btusb_setup_intel_patching() should return an int type value.
> > 
> > This bug makes the judgement "if (ret < 0)" not working on x86_64
> > architecture systems, leading to failure as below, even panic.
> > ...
> > For not affecting other modules, I choose to modify the return values
> > but not extend btusb_setup_intel() and btusb_setup_intel_patching()'s
> > return types. This is harmless, because the return values were only
> > used to comparing number 0.
> 
> there are tons of examples in various subsystems and drivers where we
> return PTR_ERR from a function calls returning int.
> 
> So I wonder what is actually going wrong here. If this is x86_64
> specific problem with PTR_ERR vs int, then we should have this problem
> everywhere in the kernel.

Hi, Marcel

I see you point, the difference between here and other subsystems are:

1, it returns -PTR_ERR() here but all other places return PTR_ERR(), I
checked.
2, the judgement is "if (ret < 0)" here but other places are "if (ret)".

I'm not saying other subsystems are 100% right, but here, returning
-PTR_ERR() and checking "if (ret < 0)" make the judgement broken much
much more easily.

I attached a testing C file, run it on x86_64, you will see the bug.

PS, about other subsystems, I also think returning PTR_ERR() from a
function calls returning int considered harmful sometimes, will talk
about that in other thread.

Great thanks.

-- 
Regards,
Adam Lee
Hardware Enablement
#include <stdio.h>

static inline long PTR_ERR(const void *ptr)
{
	return (long) ptr;
}

int main(int argc, const char *argv[])
{
	printf("sizeof(char) = %lu, sizeof(int) = %lu, sizeof(long) = %lu\n\n",
			sizeof(char), sizeof(int), sizeof(long));

	/*This address is in kernel space, check Documentation/x86/x86_64/mm.txt*/
	void *ptr = (void *)0Xffff8900f0000000;

	printf("ptr = %p, PTR_ERR(ptr) = %lx, (int)(-PTR_ERR(ptr)) = %d\n\n",
			ptr, PTR_ERR(ptr), (int)(-PTR_ERR(ptr)));

	if ((int)(-PTR_ERR(ptr)) < 0)
		printf("That's what the codes want.\n");
	else
		printf("Bug happens!\n");

	return 0;
}