linux-kernel - Re: [PATCH v5 02/23] drm/i2c: tda998x: check more I/O errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 2 Feb 2014 16:20:58 +0000
From:	Russell King - ARM Linux <linux@....linux.org.uk>
To:	Jean-Francois Moine <moinejf@...e.fr>
Cc:	dri-devel@...ts.freedesktop.org, Dave Airlie <airlied@...il.com>,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	Rob Clark <robdclark@...il.com>
Subject: Re: [PATCH v5 02/23] drm/i2c: tda998x: check more I/O errors

On Sat, Jan 25, 2014 at 06:14:45PM +0100, Jean-Francois Moine wrote:
> This patch adds more error checking inn I2C I/O functions.
> In case of I/O error, this permits to avoid writing in bad controller
> pages, a bad chipset detection or looping when getting the EDID.

I've just looked at this again, and spotted something:

> -static uint8_t
> +static int
>  reg_read(struct tda998x_priv *priv, uint16_t reg)
>  {
>  	uint8_t val = 0;
> -	reg_read_range(priv, reg, &val, sizeof(val));
> +	int ret;
> +
> +	ret = reg_read_range(priv, reg, &val, sizeof(val));
> +	if (ret < 0)
> +		return ret;

So yes, this can return negative numbers.

> @@ -1158,8 +1184,11 @@ tda998x_encoder_init(struct i2c_client *client,
>  	tda998x_reset(priv);
>  
>  	/* read version: */
> -	priv->rev = reg_read(priv, REG_VERSION_LSB) |
> -			reg_read(priv, REG_VERSION_MSB) << 8;
> +	ret = reg_read(priv, REG_VERSION_LSB) |
> +		(reg_read(priv, REG_VERSION_MSB) << 8);
> +	if (ret < 0)
> +		goto fail;
> +	priv->rev = ret;

Two issues here:

1. The additional parens are /really/ not required.
2. What if reg_read(priv, REG_VERSION_MSB) returns a negative number?

If we're going to the extent of attempting to make the read/write
functions return errors, we should at least handle errors generated
by them properly, otherwise it's pointless making them return errors.

	ret = reg_read(priv, REG_VERSION_LSB);
	if (ret < 0)
		goto fail;

	priv->rev = ret;

	ret = reg_read(priv, REG_VERSION_MSB);
	if (ret < 0)
		goto fail;

	priv->rev |= ret << 8;

If you want it to look slightly nicer:

	int rev_lo, rev_hi;

	rev_lo = reg_read(priv, REG_VERSION_LSB);
	rev_hi = reg_read(priv, REG_VERSION_MSB);
	if (rev_lo < 0 || rev_hi < 0) {
		ret = rev_lo < 0 ? rev_lo : rev_hi;
		goto fail;
	}

	priv->rev = rev_lo | rev_hi << 8;

I'm happy to commit such a change after this patch to clean it up, or if
you want to regenerate your patch 2 and post /just/ that incorporating
this change.

-- 
FTTC broadband for 0.8mile line: 5.8Mbps down 500kbps up.  Estimation
in database were 13.1 to 19Mbit for a good line, about 7.5+ for a bad.
Estimate before purchase was "up to 13.2Mbit".
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/