linux-kernel - Re: drm/exynos: scaler: Reset hardware before starting the operation (bug report)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 22 Jul 2019 19:05:58 +0200
From:   Marek Szyprowski <m.szyprowski@...sung.com>
To:     Colin Ian King <colin.king@...onical.com>,
        Andrzej Pietrasiewicz <andrzej.p@...sung.com>,
        Inki Dae <inki.dae@...sung.com>,
        linux-samsung-soc@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org
Subject: Re: drm/exynos: scaler: Reset hardware before starting the
 operation (bug report)

Hi,

On 2019-07-05 18:09, Colin Ian King wrote:
> Static analysis on today's linux-next has found a potential error in the
> following commit:
>
> commit 280e54c9f614c88292685383cf2d65057586e9fb
> Author: Andrzej Pietrasiewicz <andrzej.p@...sung.com>
> Date:   Thu Jun 7 13:06:08 2018 +0200
>
>      drm/exynos: scaler: Reset hardware before starting the operation
>
> In the following code the retry counter does not appear to be
> decremented, so potentially the loop could get stuck forever if the H/W
> does not change state:
>
> static inline int scaler_reset(struct scaler_context *scaler)
> {
>          int retry = SCALER_RESET_WAIT_RETRIES;
>
>          scaler_write(SCALER_CFG_SOFT_RESET, SCALER_CFG);
>          do {
>                  cpu_relax();
>          } while (retry > 1 &&
>                   scaler_read(SCALER_CFG) & SCALER_CFG_SOFT_RESET);
>
>          do {
>                  cpu_relax();
>                  scaler_write(1, SCALER_INT_EN);
>          } while (retry > 0 && scaler_read(SCALER_INT_EN) != 1);
>
>          return retry ? 0 : -EIO;
> }
>
> Maybe I'm missing something here subtle.

Right. Indeed there is missing decrementation of the 'retry' variable. I 
suggest to add it to both loops and reset retry value to 
SCALER_RESET_WAIT_RETRIES between them.

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland