lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 29 Nov 2014 05:14:13 +0300 From: Alexander Kochetkov <al.kochet@...il.com> To: Tony Lindgren <tony@...mide.com> Cc: Kevin Hilman <khilman@...nel.org>, linux-omap@...r.kernel.org, linux-i2c@...r.kernel.org, linux-kernel@...r.kernel.org, Felipe Balbi <balbi@...com>, Wolfram Sang <wsa@...-dreams.de> Subject: Re: [RFC] i2c: omap: TEST: do IP reset during probe. 29 нояб. 2014 г., в 1:13, Tony Lindgren <tony@...mide.com> написал(а): > Looks like for some time 2430 i2c has not been behaving > reliably commit dd74548ddece4b9d68e5528287a272fa552c81d0 ("i2c: omap: resize fifos before each message") dropped check for dev->buf_len. As result, data processing loop cause dev->buf overruns for devices with 16-bit data register (omap2420 only). Found by code review. I have the patch for that. omap2420 actually broken at all. But I'm not ready to send it right now. Part of the patch: - while (num_bytes--) { + while (num_bytes) { w = omap_i2c_read_reg(dev, OMAP_I2C_DATA_REG); *dev->buf++ = w; dev->buf_len--; + num_bytes--; /* * Data reg in 2430, omap3 and * omap4 is 8 bit wide */ if (dev->flags & OMAP_I2C_FLAG_16BIT_DATA_REG) { - *dev->buf++ = w >> 8; - dev->buf_len--; + if (num_bytes) { + *dev->buf++ = w >> 8; + dev->buf_len--; + num_bytes--; + } } } - while (num_bytes--) { + while (num_bytes) { if (dev->errata & I2C_OMAP_ERRATA_I462) { int ret; @@ -931,14 +947,18 @@ static int omap_i2c_transmit_data(struct omap_i2c_dev *dev, u8 num_bytes, w = *dev->buf++; dev->buf_len--; + num_bytes--; /* * Data reg in 2430, omap3 and * omap4 is 8 bit wide */ if (dev->flags & OMAP_I2C_FLAG_16BIT_DATA_REG) { - w |= *dev->buf++ << 8; - dev->buf_len--; + if (num_bytes) { + w |= *dev->buf++ << 8; + dev->buf_len--; + num_bytes--; + } } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists