linux-kernel - Re: [PATCH] media: ov2740: add NVMEM interface to read customized OTP data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 17 Jul 2020 20:06:10 +0900
From:   Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
To:     Bingbu Cao <bingbu.cao@...el.com>
Cc:     linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        sakari.ailus@...ux.intel.com, srinivas.kandagatla@...aro.org,
        tfiga@...omium.org, bingbu.cao@...ux.intel.com
Subject: Re: [PATCH] media: ov2740: add NVMEM interface to read customized
 OTP data

On (20/06/12 17:42), Bingbu Cao wrote:
>  
> +static int ov2740_nvmem_read(void *priv, unsigned int off, void *val,
> +			     size_t count)
> +{
> +	struct nvm_data *nvm = priv;
> +
> +	memcpy(val, nvm->nvm_buffer + off, count);
> +
> +	return 0;
> +}
> +
> +static int ov2740_register_nvmem(struct i2c_client *client)
> +{
> +	struct nvm_data *nvm;
> +	struct regmap_config regmap_config = { };
> +	struct nvmem_config nvmem_config = { };
> +	struct regmap *regmap;
> +	struct device *dev = &client->dev;
> +	int ret = 0;
> +
> +	nvm = devm_kzalloc(dev, sizeof(*nvm), GFP_KERNEL);
> +	if (!nvm)
> +		return -ENOMEM;
> +
> +	regmap_config.val_bits = 8;
> +	regmap_config.reg_bits = 16;
> +	regmap_config.disable_locking = true;
> +	regmap = devm_regmap_init_i2c(client, &regmap_config);
> +	if (IS_ERR(regmap))
> +		return PTR_ERR(regmap);
> +
> +	nvm->regmap = regmap;
> +
> +	nvmem_config.name = dev_name(dev);
> +	nvmem_config.dev = dev;
> +	nvmem_config.read_only = true;
> +	nvmem_config.root_only = true;
> +	nvmem_config.owner = THIS_MODULE;
> +	nvmem_config.compat = true;
> +	nvmem_config.base_dev = dev;
> +	nvmem_config.reg_read = ov2740_nvmem_read;
> +	nvmem_config.reg_write = NULL;
> +	nvmem_config.priv = nvm;
> +	nvmem_config.stride = 1;
> +	nvmem_config.word_size = 1;
> +	nvmem_config.size = CUSTOMER_USE_OTP_SIZE;
> +
> +	nvm->nvmem = devm_nvmem_register(dev, &nvmem_config);
> +	if (IS_ERR(nvm->nvmem))
> +		return PTR_ERR(nvm->nvmem);

This registers the NVM device, but the underlying structure is not
completely initialized yet. For instance, the ->num_buffer, which
->reg_read() uses as buffer base address, is still NULL at this point.
I'd be more comfortable if we first fully setup/prepare everything and
only then register the device.

> +
> +	nvm->nvm_buffer = devm_kzalloc(dev, CUSTOMER_USE_OTP_SIZE, GFP_KERNEL);
> +	if (!nvm->nvm_buffer)
> +		return -ENOMEM;

If this allocation fails, we return the error, which is handler as
dev_err() only, and keep everting as is. So any attempt of ->req_read()
will effectively do

	memcpy(val, NULL + off, count);

> +	ret = ov2740_load_otp_data(client, nvm);
> +	if (ret)
> +		dev_err(dev, "failed to load OTP data, ret %d\n", ret);
> +
> +	return ret;
> +}

If this step fails, the NVM device is still registered and available
and we still can call ->req_read(). Is this correct? Do we need to
have an "error out" path there and unregister the NVM device?

>  static int ov2740_probe(struct i2c_client *client)
>  {
>  	struct ov2740 *ov2740;
> @@ -964,6 +1105,10 @@ static int ov2740_probe(struct i2c_client *client)
>  		goto probe_error_media_entity_cleanup;
>  	}
>  
> +	ret = ov2740_register_nvmem(client);
> +	if (ret)
> +		dev_err(&client->dev, "register nvmem failed, ret %d\n", ret);
> +

Either this better be a fatal error, or we need to have an error-out
rollback/cleanup in ov2740_register_nvmem().

>  	/*
>  	 * Device is already turned on by i2c-core with ACPI domain PM.
>  	 * Enable runtime PM and turn off the device.

	-ss