linux-kernel - RE: [PATCH] usb: dwc3: core: modify IO memory resource after deferred probe completes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 25 Jul 2013 19:46:58 +0000
From:	Paul Zimmerman <Paul.Zimmerman@...opsys.com>
To:	"Ivan T. Ivanov" <iivanov@...sol.com>,
	"balbi@...com" <balbi@...com>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-omap@...r.kernel.org" <linux-omap@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] usb: dwc3: core: modify IO memory resource after
 deferred probe completes

> From: Ivan T. Ivanov
> Sent: Thursday, July 25, 2013 9:27 AM
> 
> When deferred probe happens driver will try to ioremap multiple times
> and will fail. Memory resource.start variable is a global variable,
> modifications in this field will be accumulated on every probe.
> Fix this by moving the above operations after driver hold all
> required PHY's.
> 
> Signed-off-by: Ivan T. Ivanov <iivanov@...sol.com>
> ---
>  drivers/usb/dwc3/core.c |   31 ++++++++++++++++---------------
>  1 file changed, 16 insertions(+), 15 deletions(-)
> 
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index 607bef8..50c833f 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -384,21 +384,6 @@ static int dwc3_probe(struct platform_device *pdev)
>  		dev_err(dev, "missing memory resource\n");
>  		return -ENODEV;
>  	}
> -	dwc->xhci_resources[0].start = res->start;
> -	dwc->xhci_resources[0].end = dwc->xhci_resources[0].start +
> -					DWC3_XHCI_REGS_END;
> -	dwc->xhci_resources[0].flags = res->flags;
> -	dwc->xhci_resources[0].name = res->name;
> -
> -	res->start += DWC3_GLOBALS_REGS_START;
> -
> -	 /*
> -	  * Request memory region but exclude xHCI regs,
> -	  * since it will be requested by the xhci-plat driver.
> -	  */
> -	regs = devm_ioremap_resource(dev, res);
> -	if (IS_ERR(regs))
> -		return PTR_ERR(regs);
> 
>  	if (node) {
>  		dwc->maximum_speed = of_usb_get_maximum_speed(node);
> @@ -452,6 +437,22 @@ static int dwc3_probe(struct platform_device *pdev)
>  		return -EPROBE_DEFER;
>  	}
> 
> +	dwc->xhci_resources[0].start = res->start;
> +	dwc->xhci_resources[0].end = dwc->xhci_resources[0].start +
> +					DWC3_XHCI_REGS_END;
> +	dwc->xhci_resources[0].flags = res->flags;
> +	dwc->xhci_resources[0].name = res->name;
> +
> +	res->start += DWC3_GLOBALS_REGS_START;

Ick. The driver is modifying the struct resource passed to it by the
platform code? That seems like a layering violation, and is fragile as
hell. In addition to this bug, what would happen if the struct resource
was declared 'const'?

-- 
Paul

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/