linux-kernel - Re: [PATCH v2 1/6] zorro_esp: Limit DMA transfers to 65535 bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19de2671-ea20-3917-7ed6-4b8217fe17ad@gmail.com>
Date:   Sun, 14 Oct 2018 20:35:23 +1300
From:   Michael Schmitz <schmitzmic@...il.com>
To:     Finn Thain <fthain@...egraphics.com.au>,
        "James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>
Cc:     Hannes Reinecke <hare@...e.de>, linux-scsi@...r.kernel.org,
        linux-m68k@...ts.linux-m68k.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/6] zorro_esp: Limit DMA transfers to 65535 bytes

Hi Finn,

thanks for spotting this!

Am 14.10.2018 um 19:12 schrieb Finn Thain:
> The core driver, esp_scsi, does not use the ESP_CONFIG2_FENAB bit, so
> the chip's Transfer Counter register is only 16 bits wide (not 24).
> A larger transfer cannot work and will theoretically result in a failed
> command and a "DMA length is zero" error.
>
> Fixes: 3109e5ae0311
> Signed-off-by: Finn Thain <fthain@...egraphics.com.au>
> Cc: Michael Schmitz <schmitzmic@...il.com>
> Tested-by: Michael Schmitz <schmitzmic@...il.com>

Reviewed-by: Michael Schmitz <schmitzmic@...il.com>

> ---
>  drivers/scsi/zorro_esp.c | 8 +-------
>  1 file changed, 1 insertion(+), 7 deletions(-)
>
> diff --git a/drivers/scsi/zorro_esp.c b/drivers/scsi/zorro_esp.c
> index bb70882e6b56..be79127db594 100644
> --- a/drivers/scsi/zorro_esp.c
> +++ b/drivers/scsi/zorro_esp.c
> @@ -245,7 +245,7 @@ static int fastlane_esp_irq_pending(struct esp *esp)
>  static u32 zorro_esp_dma_length_limit(struct esp *esp, u32 dma_addr,
>  					u32 dma_len)
>  {
> -	return dma_len > 0xFFFFFF ? 0xFFFFFF : dma_len;
> +	return dma_len > 0xFFFF ? 0xFFFF : dma_len;
>  }
>
>  static void zorro_esp_reset_dma(struct esp *esp)
> @@ -484,7 +484,6 @@ static void zorro_esp_send_blz1230_dma_cmd(struct esp *esp, u32 addr,
>  	scsi_esp_cmd(esp, ESP_CMD_DMA);
>  	zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
>  	zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
> -	zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
>
>  	scsi_esp_cmd(esp, cmd);
>  }
> @@ -529,7 +528,6 @@ static void zorro_esp_send_blz1230II_dma_cmd(struct esp *esp, u32 addr,
>  	scsi_esp_cmd(esp, ESP_CMD_DMA);
>  	zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
>  	zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
> -	zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
>
>  	scsi_esp_cmd(esp, cmd);
>  }
> @@ -574,7 +572,6 @@ static void zorro_esp_send_blz2060_dma_cmd(struct esp *esp, u32 addr,
>  	scsi_esp_cmd(esp, ESP_CMD_DMA);
>  	zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
>  	zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
> -	zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
>
>  	scsi_esp_cmd(esp, cmd);
>  }
> @@ -599,7 +596,6 @@ static void zorro_esp_send_cyber_dma_cmd(struct esp *esp, u32 addr,
>
>  	zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
>  	zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
> -	zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
>
>  	if (write) {
>  		/* DMA receive */
> @@ -649,7 +645,6 @@ static void zorro_esp_send_cyberII_dma_cmd(struct esp *esp, u32 addr,
>
>  	zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
>  	zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
> -	zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
>
>  	if (write) {
>  		/* DMA receive */
> @@ -691,7 +686,6 @@ static void zorro_esp_send_fastlane_dma_cmd(struct esp *esp, u32 addr,
>
>  	zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
>  	zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
> -	zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
>
>  	if (write) {
>  		/* DMA receive */
>