linux-kernel - Re: [PATCH v3 2/2] checks: Improve i2c reg property checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 2 Jun 2020 11:01:04 +0300
From:   Serge Semin <Sergey.Semin@...kalelectronics.ru>
To:     Joel Stanley <joel@....id.au>
CC:     Serge Semin <fancer.lancer@...il.com>,
        Wolfram Sang <wsa@...-dreams.de>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Rob Herring <robh+dt@...nel.org>,
        <devicetree-compiler@...r.kernel.org>,
        David Gibson <david@...son.dropbear.id.au>,
        <linux-kernel@...r.kernel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Arnd Bergmann <arnd@...db.de>
Subject: Re: [PATCH v3 2/2] checks: Improve i2c reg property checking

On Thu, May 28, 2020 at 06:26:50PM +0930, Joel Stanley wrote:
> The i2c bindings in the kernel tree describe support for 10 bit
> addressing, which must be indicated with the I2C_TEN_BIT_ADDRESS flag.
> When this is set the address can be up to 10 bits. When it is not set
> the address is a maximum of 7 bits.
> 
> See Documentation/devicetree/bindings/i2c/i2c.txt.
> 
> Take into account this flag when checking the address is valid.
> 
> Signed-off-by: Joel Stanley <joel@....id.au>
> ---
> v2: Mask reg when checking the 10-bit size
> ---
>  checks.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/checks.c b/checks.c
> index feb1721f2603..3fe979a63290 100644
> --- a/checks.c
> +++ b/checks.c
> @@ -1023,6 +1023,7 @@ static void check_i2c_bus_bridge(struct check *c, struct dt_info *dti, struct no
>  WARNING(i2c_bus_bridge, check_i2c_bus_bridge, NULL, &addr_size_cells);
>  
>  #define I2C_OWN_SLAVE_ADDRESS	(1 << 30)

> +#define I2C_TEN_BIT_ADDRESS	(1 << 31)

As Andy neatly pointed out here:
https://lore.kernel.org/lkml/20200527133656.GV1634618@smile.fi.intel.com/
(1 << 31) is UB.

-Sergey

>  
>  static void check_i2c_bus_reg(struct check *c, struct dt_info *dti, struct node *node)
>  {
> @@ -1057,10 +1058,13 @@ static void check_i2c_bus_reg(struct check *c, struct dt_info *dti, struct node
>  		reg = fdt32_to_cpu(*(cells++));
>  		/* Ignore I2C_OWN_SLAVE_ADDRESS */
>  		reg &= ~I2C_OWN_SLAVE_ADDRESS;
> -		if (reg > 0x3ff)
> +
> +		if ((reg & I2C_TEN_BIT_ADDRESS) && ((reg & ~I2C_TEN_BIT_ADDRESS) > 0x3ff))
>  			FAIL_PROP(c, dti, node, prop, "I2C address must be less than 10-bits, got \"0x%x\"",
>  				  reg);
> -
> +		else if (reg > 0x7f)
> +			FAIL_PROP(c, dti, node, prop, "I2C address must be less than 7-bits, got \"0x%x\". Set I2C_TEN_BIT_ADDRESS for 10 bit addresses or fix the property",
> +				  reg);
>  	}
>  }
>  WARNING(i2c_bus_reg, check_i2c_bus_reg, NULL, &reg_format, &i2c_bus_bridge);
> -- 
> 2.26.2
>