linux-kernel - Re: [PATCH v3] cfi: fix deadloop in cfi_cmdset_0002.c do_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Feb 2019 16:42:28 +0100
From:   Boris Brezillon <boris.brezillon@...labora.com>
To:     "liujian (CE)" <liujian56@...wei.com>
Cc:     Tokunori Ikegami <ikegami.t@...il.com>,
        "dwmw2@...radead.org" <dwmw2@...radead.org>,
        "computersforpeace@...il.com" <computersforpeace@...il.com>,
        "bbrezillon@...nel.org" <bbrezillon@...nel.org>,
        "marek.vasut@...il.com" <marek.vasut@...il.com>,
        "richard@....at" <richard@....at>,
        "ikegami@...ied-telesis.co.jp" <ikegami@...ied-telesis.co.jp>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "vigneshr@...com" <vigneshr@...com>,
        "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3] cfi: fix deadloop in cfi_cmdset_0002.c
 do_write_buffer

On Thu, 28 Feb 2019 15:12:15 +0000
"liujian (CE)" <liujian56@...wei.com> wrote:

> > -----Original Message-----
> > From: Tokunori Ikegami [mailto:ikegami.t@...il.com]
> > Sent: Thursday, February 28, 2019 10:26 PM
> > To: liujian (CE) <liujian56@...wei.com>; dwmw2@...radead.org;
> > computersforpeace@...il.com; bbrezillon@...nel.org;
> > marek.vasut@...il.com; richard@....at; joakim.tjernlund@...inera.com;
> > ikegami@...ied-telesis.co.jp; keescook@...omium.org; vigneshr@...com
> > Cc: linux-mtd@...ts.infradead.org; linux-kernel@...r.kernel.org
> > Subject: RE: [PATCH v3] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
> > 
> > 
> >   
> > > -----Original Message-----
> > > From: linux-mtd [mailto:linux-mtd-bounces@...ts.infradead.org] On
> > > Behalf Of Liu Jian
> > > Sent: Tuesday, February 26, 2019 11:01 PM
> > > To: dwmw2@...radead.org; computersforpeace@...il.com;
> > > bbrezillon@...nel.org; marek.vasut@...il.com; richard@....at;
> > > joakim.tjernlund@...inera.com; ikegami@...ied-telesis.co.jp;
> > > keescook@...omium.org; vigneshr@...com
> > > Cc: linux-mtd@...ts.infradead.org; liujian56@...wei.com;
> > > linux-kernel@...r.kernel.org
> > > Subject: [PATCH v3] cfi: fix deadloop in cfi_cmdset_0002.c
> > > do_write_buffer
> > >
> > > In function do_write_buffer(), in the for loop, there is a case
> > > chip_ready() returns 1 while chip_good() returns 0, so it never break
> > > the loop.
> > > To fix this, chip_good() is enough and it should timeout if it stay
> > > bad for a while.
> > >
> > > Fixes: dfeae1073583("mtd: cfi_cmdset_0002: Change write buffer to
> > > check correct value")
> > > Signed-off-by: Yi Huaijie <yihuaijie@...wei.com>
> > > Signed-off-by: Liu Jian <liujian56@...wei.com>
> > > Reviewed-by: Tokunori Ikegami <ikegami_to@...oo.co.jp>
> > > ---
> > > v2->v3:
> > > Follow Vignesh's advice:
> > > add one more check for check_good() even when time_after() returns true.
> > >
> > >  drivers/mtd/chips/cfi_cmdset_0002.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c
> > > b/drivers/mtd/chips/cfi_cmdset_0002.c
> > > index 72428b6..3da2376 100644
> > > --- a/drivers/mtd/chips/cfi_cmdset_0002.c
> > > +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
> > > @@ -1876,7 +1876,7 @@ static int __xipram do_write_buffer(struct
> > > map_info *map, struct flchip *chip,
> > >  			continue;
> > >  		}
> > >
> > > -		if (time_after(jiffies, timeo) && !chip_ready(map, adr))
> > > +		if (time_after(jiffies, timeo) && !chip_good(map, adr,
> > > datum))  
> > 
> >   Just another idea to understand easily.
> > 
> >     unsigned long now = jiffies;
> > 
> >     if (chip_good(map, adr, datum)) {
> >         xip_enable(map, chip, adr);
> >         goto op_done;
> >     }
> > 
> >     if (time_after(now, timeo) {
> >         break;
> >     }
> >   
> 
> Thank you~. It is more easier to understand！
> If there are no other comments, I will send new patch again ): 

Except this version no longer does what Vignesh suggested. See how you
no longer test if chip_good() is true if time_after() returns true. So,
imagine the thread entering this function is preempted just after the
first chip_good() test, and resumed a few ms later. time_after() will
return true, but chip_good() might also return true, and you ignore it.