lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Sat,  4 Apr 2015 04:39:07 +0200
From:	Nicholas Mc Guire <hofrat@...dl.org>
To:	David Airlie <airlied@...ux.ie>
Cc:	Hai Li <hali@...eaurora.org>, Rob Clark <robdclark@...il.com>,
	dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
	Nicholas Mc Guire <hofrat@...dl.org>
Subject: [PATCH 1/3] drm/msm: fixup wait_for_completion_timeout handling

wait_for_completion_timeout return >= 0 but never negative so the check 
logic looks inconsistent. Further the return value of 
wait_for_completion_timeout was being passed up the call chain but the
x call sites as drm_dp_i2c_do_msg()/drm_dp_dpcd_access() check for < 0 
thus timeout was being treated as success case.

<snip> drivers/gpu/drm/drm_dp_helper.c:drm_dp_i2c_do_msg()
                mutex_lock(&aux->hw_mutex);
                ret = aux->transfer(aux, msg);
                mutex_unlock(&aux->hw_mutex);
                if (ret < 0) {
<snip>
logic in edp_aux_transfer() seems incorrect as it could return 0 (timeout)
but checks of <= 0 to indicate error so the return probably should be
-ETIMEDOUT in case wait_for_completion_timeout returns 0 (timeout 
occurred).

Signed-off-by: Nicholas Mc Guire <hofrat@...dl.org>
---

This was compile tested with qcom_defconfig +    
CONFIG_DRM=m (implies CONFIG_DRM_MSM=m)

Patch is against 4.0-rc6 (localversion-next is -next-20150402)

 drivers/gpu/drm/msm/edp/edp_aux.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/edp/edp_aux.c b/drivers/gpu/drm/msm/edp/edp_aux.c
index 5f5a84f..1d2ccdf 100644
--- a/drivers/gpu/drm/msm/edp/edp_aux.c
+++ b/drivers/gpu/drm/msm/edp/edp_aux.c
@@ -119,6 +119,7 @@ ssize_t edp_aux_transfer(struct drm_dp_aux *drm_aux, struct drm_dp_aux_msg *msg)
 {
 	struct edp_aux *aux = to_edp_aux(drm_aux);
 	ssize_t ret;
+	unsigned long time_left;
 	bool native = msg->request & (DP_AUX_NATIVE_WRITE & DP_AUX_NATIVE_READ);
 	bool read = msg->request & (DP_AUX_I2C_READ & DP_AUX_NATIVE_READ);
 
@@ -147,15 +148,16 @@ ssize_t edp_aux_transfer(struct drm_dp_aux *drm_aux, struct drm_dp_aux_msg *msg)
 		goto unlock_exit;
 
 	DBG("wait_for_completion");
-	ret = wait_for_completion_timeout(&aux->msg_comp, 300);
-	if (ret <= 0) {
+	time_left = wait_for_completion_timeout(&aux->msg_comp, 300);
+	if (!time_left) {
 		/*
 		 * Clear GO and reset AUX channel
 		 * to cancel the current transaction.
 		 */
 		edp_write(aux->base + REG_EDP_AUX_TRANS_CTRL, 0);
 		msm_edp_aux_ctrl(aux, 1);
-		pr_err("%s: aux timeout, %d\n", __func__, ret);
+		pr_err("%s: aux timeout, %lu\n", __func__, time_left);
+		ret = -ETIMEDOUT;
 		goto unlock_exit;
 	}
 	DBG("completion");
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists