linux-kernel - Re: [PATCH v6 5/6] usb:cdns3 Add Cadence USB3 DRD Driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b768bde9-d6c8-f655-aecb-d08bcb9286a6@ti.com>
Date:   Tue, 4 Jun 2019 13:16:09 +0530
From:   Sekhar Nori <nsekhar@...com>
To:     Pawel Laszczak <pawell@...ence.com>, <devicetree@...r.kernel.org>
CC:     <gregkh@...uxfoundation.org>, <felipe.balbi@...ux.intel.com>,
        <mark.rutland@....com>, <linux-usb@...r.kernel.org>,
        <hdegoede@...hat.com>, <heikki.krogerus@...ux.intel.com>,
        <andy.shevchenko@...il.com>, <robh+dt@...nel.org>, <rogerq@...com>,
        <linux-kernel@...r.kernel.org>, <jbergsagel@...com>, <nm@...com>,
        <sureshp@...ence.com>, <peter.chen@....com>, <kurahul@...ence.com>
Subject: Re: [PATCH v6 5/6] usb:cdns3 Add Cadence USB3 DRD Driver

On 10/04/19 1:18 PM, Pawel Laszczak wrote:
> +static void cdns3_wa1_tray_restore_cycle_bit(struct cdns3_device *priv_dev,
> +					     struct cdns3_endpoint *priv_ep)
> +{
> +	int dma_index;
> +	u32 doorbell;
> +
> +	doorbell = !!(readl(&priv_dev->regs->ep_cmd) & EP_CMD_DRDY);

> +	dma_index = (readl(&priv_dev->regs->ep_traddr) -
> +		    priv_ep->trb_pool_dma) / TRB_SIZE;

This gets upgraded to 64-bit by 64-bit division whenever dma_addr_t is 
64-bit. That should be avoided. Following diff should fix it. 
But please review the logic itself. You are subtracting a 64 bit entity 
from a 32-bit entity. What is guaranteeing that priv_ep->trb_pool_dma is 
32-bit?

There is one more instance of same issue in cdns3_request_handled().

Thanks,
Sekhar

[1]
diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
index bfd5dbf40c7e..e73b618501fb 100644
--- a/drivers/usb/cdns3/gadget.c
+++ b/drivers/usb/cdns3/gadget.c
@@ -749,8 +749,8 @@ static void cdns3_wa1_tray_restore_cycle_bit(struct cdns3_device *priv_dev,
 	u32 doorbell;
 
 	doorbell = !!(readl(&priv_dev->regs->ep_cmd) & EP_CMD_DRDY);
-	dma_index = (readl(&priv_dev->regs->ep_traddr) -
-		    priv_ep->trb_pool_dma) / TRB_SIZE;
+	dma_index = readl(&priv_dev->regs->ep_traddr) - priv_ep->trb_pool_dma;
+	dma_index /= TRB_SIZE;