linux-kernel - Re: [PATCH 3/3] pinctrl: single: fix infinite loop caused by bad mask

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131130172147.GC23334@atomide.com>
Date:	Sat, 30 Nov 2013 09:21:48 -0800
From:	Tony Lindgren <tony@...mide.com>
To:	Tomi Valkeinen <tomi.valkeinen@...com>
Cc:	linux-kernel@...r.kernel.org,
	Peter Ujfalusi <peter.ujfalusi@...com>
Subject: Re: [PATCH 3/3] pinctrl: single: fix infinite loop caused by bad
 mask

* Tomi Valkeinen <tomi.valkeinen@...com> [131128 03:30]:
> If the masks in DT data are not quite right,
> pcs_parse_bits_in_pinctrl_entry() can end up in an infinite loop,
> trashing memory at the same time.
> 
> Add a check to verify that each loop actually removes bits from the
> 'mask', so that the loop can eventually end.

Linus W, might be worth updating the change log with the regression
causing commit. Something like commit 4e7e8017a80e1 (pinctrl: pinctrl-single:
enhance to configure multiple pins of different modules) improved
support for pinctrl-single,bits option, but also caused a regression
in parsing badly configured mask data.

Acked-by: Tony Lindgren <tony@...mide.com>
 
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@...com>
> ---
>  drivers/pinctrl/pinctrl-single.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
> index 174f4c50cd77..de6459628b4f 100644
> --- a/drivers/pinctrl/pinctrl-single.c
> +++ b/drivers/pinctrl/pinctrl-single.c
> @@ -1318,6 +1318,14 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
>  			mask_pos = ((pcs->fmask) << (bit_pos - 1));
>  			val_pos = val & mask_pos;
>  			submask = mask & mask_pos;
> +
> +			if ((mask & mask_pos) == 0) {
> +				dev_err(pcs->dev,
> +					"Invalid mask for %s at 0x%x\n",
> +					np->name, offset);
> +				break;
> +			}
> +
>  			mask &= ~mask_pos;
>  
>  			if (submask != mask_pos) {
> -- 
> 1.8.3.2
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/