linux-kernel - Re: [PATCH] mtd: m25p80: consider max message size when use the spi_mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180820155451.03d770eb@bbrezillon>
Date:   Mon, 20 Aug 2018 15:54:51 +0200
From:   Boris Brezillon <boris.brezillon@...tlin.com>
To:     David Laight <David.Laight@...LAB.COM>
Cc:     'Chuanhua Han' <chuanhua.han@....com>,
        "broonie@...nel.org" <broonie@...nel.org>,
        "linux-spi@...r.kernel.org" <linux-spi@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "jiafei.pan@....com" <jiafei.pan@....com>,
        "zhiqiang.hou@....com" <zhiqiang.hou@....com>
Subject: Re: [PATCH] mtd: m25p80: consider max message size when use the
 spi_mem_xx() API

On Mon, 20 Aug 2018 13:01:13 +0000
David Laight <David.Laight@...LAB.COM> wrote:

> From: Chuanhua Han
> > Sent: 20 August 2018 13:44
> > 

Still no message here, and the subject prefix is still wrong.


Fixes and Cc-stable tags should be placed here...

> > Signed-off-by: Chuanhua Han <chuanhua.han@....com>
> > ---
> > Changes in v3:
> >     Rename variable name "val" to "opcode_addr_dummy_sum".
> >     Place the legitimacy of the transfer size(i.e., "pi_max_message_size(mem->spi)" and
> > "opcode_addr_dummy_sum") into "if (! ctlr - > mem_ops | |! ctlr-> mem_ops->exec_op) {"
> > structure and add "spi_max_transfer_size(mem->spi) and opcode_addr_dummy_sum".
> >     Adjust the formatting alignment of your code.
> >     "(unsigned long)op->data.nbytes" was modified to "(unsigned long)(op->data.nbytes)".
> > 
> > Fixes: c36ff266dc82 ("spi: Extend the core to ease integration of SPI memory controllers")

... not here.

The changelog should also contain a "Changes in v2" section.

> > ---
> >  drivers/spi/spi-mem.c | 14 ++++++++++++++
> >  1 file changed, 14 insertions(+)
> > 
> > diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
> > index 990770d..5ec2bc9 100644
> > --- a/drivers/spi/spi-mem.c
> > +++ b/drivers/spi/spi-mem.c
> > @@ -328,10 +328,24 @@ EXPORT_SYMBOL_GPL(spi_mem_exec_op);
> >  int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
> >  {
> >  	struct spi_controller *ctlr = mem->spi->controller;
> > +	unsigned long opcode_addr_dummy_sum = sizeof(op->cmd.opcode) +
> > +					      op->addr.nbytes +
> > +					      op->dummy.nbytes;  
> 

Yep, the var name is definitely too long.

> I'd split that (and shorten the variable name) to avoid line wrap. Maybe:
> 
> 	unsigned long len;
> 
> 	len = sizeof(op->cmd.opcode) + op->addr.nbytes + op->dummy.nbytes;
> > 
> >  	if (ctlr->mem_ops && ctlr->mem_ops->adjust_op_size)
> >  		return ctlr->mem_ops->adjust_op_size(mem, op);
> > 
> > +	if (!ctlr->mem_ops || !ctlr->mem_ops->exec_op) {
> > +		if (spi_max_message_size(mem->spi) < opcode_addr_dummy_sum ||
> > +		    spi_max_transfer_size(mem->spi) < opcode_addr_dummy_sum)
> > +			return -EINVAL;  
> 
> Those comparisons are lexically backwards, you want 'value op constant'.
> So:
> 		if (len > spi_max_message_size(mem->spi) ||
> 		    len > spi_max_transfer_size(mem->spi))
> 			return -EINVAL.
> Although I'm surprised you need to do both comparisons.

Indeed, spi_max_transfer_size() is enough since it already does a min()
with spi_max_message_size().

> 
> > +
> > +		op->data.nbytes = min3((unsigned long)(op->data.nbytes),

Hm, you should have a cast of size_t, I guess that's what kbuild robots
reported.

> > +				       spi_max_transfer_size(mem->spi),
> > +				       spi_max_message_size(mem->spi) -
> > +				       opcode_addr_dummy_sum);  
> 
> That looks like a strange limit...

We need that to adjust the len of the 2nd transfer (called data in
spi-mem) if it's too long to fit in a SPI message or SPI transfer.

> 
> > +	}
> > +
> >  	return 0;
> >  }
> >  EXPORT_SYMBOL_GPL(spi_mem_adjust_op_size);
> > --
> > 2.7.4  
> 
> 	David
> 
> -
> Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
> Registration No: 1397386 (Wales)
>