Re: [PATCH] spi: spi-fsl-lpspi: fix watermark truncation caused by type cast

[david laight]

On Mon, 17 Nov 2025 11:03:55 +0800
carlos.song@xxxxxxx wrote:

> From: Carlos Song <carlos.song@xxxxxxx>
> 
> 't->len' is an unsigned integer, while 'watermark' and 'txfifosize' are
> u8. Using min_t with typeof(watermark) forces both values to be cast to
> u8, which truncates len when it exceeds 255. For example, len = 4096
> becomes 0 after casting, resulting in an incorrect watermark value.
> 
> Use a wider type in min_t to avoid truncation and ensure the correct
> minimum value is applied.

Also see my big patch that will detect this...

It usual that a simple min() will work fine.
(After the relaxation of the type comparison in min().)
If one of the values is a signed type (but positive) use umin(a,b).

This is a typical example of the type of the destination being used in min_t().
The real fix is to remove min_t() completely.

After all if the code had been:
	sl_lpspi->watermark = min(sl_lpspi->txfifosize,
		(typeof(fsl_lpspi->watermark))t->len);
a reviewer would have been likely to pick up the truncation.

Hiding the cast inside min_t() is a 'really bad idea' (tm).

I've found a pile of cases of:
	min_t(u8, value_32 / 2, 255)
in one driver (and the variable is pretty much called 'value_32'.

Looks like I've tried to compile this file yet.
'git diff' is currently outputting 8395 files for 358 files.

	David

> 
> Fixes: a750050349ea ("spi: spi-fsl-lpspi: use min_t() to improve code")
> Signed-off-by: Carlos Song <carlos.song@xxxxxxx>
> ---
>  drivers/spi/spi-fsl-lpspi.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
> index 8da66e101386..065456aba2ae 100644
> --- a/drivers/spi/spi-fsl-lpspi.c
> +++ b/drivers/spi/spi-fsl-lpspi.c
> @@ -486,7 +486,13 @@ static int fsl_lpspi_setup_transfer(struct spi_controller *controller,
>  		fsl_lpspi->tx = fsl_lpspi_buf_tx_u32;
>  	}
>  
> -	fsl_lpspi->watermark = min_t(typeof(fsl_lpspi->watermark),
> +	/*
> +	 * t->len is 'unsigned' and txfifosize and watermrk is 'u8', force
> +	 * type cast is inevitable. When len > 255, len will be truncated in min_t(),
> +	 * it caused wrong watermark set. 'unsigned int' is as the designated type
> +	 * for min_t() to avoid truncation.
> +	 */
> +	fsl_lpspi->watermark = min_t(unsigned int,
>  				     fsl_lpspi->txfifosize,
>  				     t->len);
>