linux-kernel - Re: [PATCH v2 2/2] i2c: core-smbus: fix a potential missing-check bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 May 2018 15:06:54 +0200
From:   Wolfram Sang <wsa@...-dreams.de>
To:     Peter Rosin <peda@...ntia.se>
Cc:     Wenwen Wang <wang6495@....edu>, Kangjie Lu <kjlu@....edu>,
        "open list:I2C SUBSYSTEM" <linux-i2c@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 2/2] i2c: core-smbus: fix a potential missing-check bug

> > hopefully I have time to write a small coccinelle rule to find if
> > constant values are returned in a function declared as master_xfer.
> 
> That would be a good thing.

Did that now and only found drivers which have a (meanwhile) needless
parameter check for 'num'. Will set you on CC for those fixes. I didn't
find any drivers incorrectly returning 0 instead of num. Except the ones
you already fixed.

> Maybe a long term goal is to simply return
> zero on success for .master_xfer, because currently the only expected
> success value is the number of messages sent, but the caller is in all
> likelihood already aware of that count, so it all seems rather like
> something that is just pointless and easy to get wrong...

Yes, the comment in the core is still true:

        /* REVISIT the fault reporting model here is weak:
         * ...

Returning 0 or -ERRNO sounds best to me, too. But we would need to make
sure there is no in-kernel user relying on the current behaviour. As you
said, this is a long-term goal at best.

> > What do you mean with "short success for some sequence" here?
> 
> By "short" I mean not all requested messages transferred. By "success"
> I mean non-negative.

Ah, I understand now, thanks.

> I.e. when I look at rcar_i2c_master_xfer(), it sets things up for all
> messages to be transferred, starts things off and waits for completion
> (or timeout). But the driver is too involved for it to be easy to say
> that either all messages are transferred or a negative error is
> returned. I never managed to see that anyway.

Well, I am the maintainer of that driver, so I can say something about
that :) The HW design has a flaw for older SoCs which makes the driver
prone to a race condition. This is why we set up new messages in
interrupt context, too. Everything else turned out to be too expensive.

> And the function has that "ret = num - priv->msgs_left;" statement
> indicating that whomever wrote it thought it perfectly ok to return
> such a "short success" (which noone is expecting).

I copied over that old behaviour when refactoring the driver. But I see
what you mean, and couldn't also really see a path where a "short
success" could actually happen.

Thanks,

   Wolfram

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)