linux-kernel - Re: [PATCH 1/1] USB: PHY: JZ4770: Fix uninitialized value written to HW register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Aug 2020 15:58:46 +0300
From:   Felipe Balbi <balbi@...nel.org>
To:     Paul Cercueil <paul@...pouillou.net>,
        周琰杰 <zhouyanjie@...yeetech.com>,
        周正 <sernia.zhou@...mail.com>,
        漆鹏振 <aric.pzqi@...enic.com>
Cc:     od@...c.me, Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        Paul Cercueil <paul@...pouillou.net>
Subject: Re: [PATCH 1/1] USB: PHY: JZ4770: Fix uninitialized value written
 to HW register


Hi,

Paul Cercueil <paul@...pouillou.net> writes:
> The 'reg' value was written to a hardware register in
> ingenic_usb_phy_init(), while not being initialized anywhere.

your patch does a lot more than fix the bug :-)

> Fixes: 2a6c0b82e651 ("USB: PHY: JZ4770: Add support for new Ingenic SoCs.")
> Signed-off-by: Paul Cercueil <paul@...pouillou.net>
> ---
>  drivers/usb/phy/phy-jz4770.c | 28 +++++++++++-----------------
>  1 file changed, 11 insertions(+), 17 deletions(-)
>
> diff --git a/drivers/usb/phy/phy-jz4770.c b/drivers/usb/phy/phy-jz4770.c
> index d4ee3cb721ea..58771a8688f2 100644
> --- a/drivers/usb/phy/phy-jz4770.c
> +++ b/drivers/usb/phy/phy-jz4770.c
> @@ -97,7 +97,7 @@ enum ingenic_usb_phy_version {
>  struct ingenic_soc_info {
>  	enum ingenic_usb_phy_version version;
>  
> -	void (*usb_phy_init)(struct usb_phy *phy);
> +	u32 (*usb_phy_init)(struct usb_phy *phy);

this is not fixing any bug

> @@ -172,7 +172,8 @@ static int ingenic_usb_phy_init(struct usb_phy *phy)
>  		return err;
>  	}
>  
> -	priv->soc_info->usb_phy_init(phy);
> +	reg = priv->soc_info->usb_phy_init(phy);
> +	writel(reg, priv->base + REG_USBPCR_OFFSET);

not fixing any bug.

Looking at the code, the bug follows after this line. It would suffice
to read REG_USBPCR_OFFSET in order to initialize reg. This bug fix could
have been a one liner.

> @@ -195,19 +196,15 @@ static void ingenic_usb_phy_remove(void *phy)
>  	usb_remove_phy(phy);
>  }
>  
> -static void jz4770_usb_phy_init(struct usb_phy *phy)
> +static u32 jz4770_usb_phy_init(struct usb_phy *phy)

not a bug fix

>  {
> -	struct jz4770_phy *priv = phy_to_jz4770_phy(phy);
> -	u32 reg;
> -
> -	reg = USBPCR_AVLD_REG | USBPCR_COMMONONN | USBPCR_IDPULLUP_ALWAYS |
> +	return USBPCR_AVLD_REG | USBPCR_COMMONONN | USBPCR_IDPULLUP_ALWAYS |
>  		USBPCR_COMPDISTUNE_DFT | USBPCR_OTGTUNE_DFT | USBPCR_SQRXTUNE_DFT |
>  		USBPCR_TXFSLSTUNE_DFT | USBPCR_TXRISETUNE_DFT | USBPCR_TXVREFTUNE_DFT |
>  		USBPCR_POR;
> -	writel(reg, priv->base + REG_USBPCR_OFFSET);

not a bug fix

>  }
>  
> -static void jz4780_usb_phy_init(struct usb_phy *phy)
> +static u32 jz4780_usb_phy_init(struct usb_phy *phy)

not a bug fix

> @@ -216,11 +213,10 @@ static void jz4780_usb_phy_init(struct usb_phy *phy)
>  		USBPCR1_WORD_IF_16BIT;
>  	writel(reg, priv->base + REG_USBPCR1_OFFSET);
>  
> -	reg = USBPCR_TXPREEMPHTUNE | USBPCR_COMMONONN | USBPCR_POR;
> -	writel(reg, priv->base + REG_USBPCR_OFFSET);
> +	return USBPCR_TXPREEMPHTUNE | USBPCR_COMMONONN | USBPCR_POR;

not a bug fix

>  }
>  
> -static void x1000_usb_phy_init(struct usb_phy *phy)
> +static u32 x1000_usb_phy_init(struct usb_phy *phy)

not a bug fix

>  {
>  	struct jz4770_phy *priv = phy_to_jz4770_phy(phy);
>  	u32 reg;
> @@ -228,13 +224,12 @@ static void x1000_usb_phy_init(struct usb_phy *phy)
>  	reg = readl(priv->base + REG_USBPCR1_OFFSET) | USBPCR1_WORD_IF_16BIT;
>  	writel(reg, priv->base + REG_USBPCR1_OFFSET);
>  
> -	reg = USBPCR_SQRXTUNE_DCR_20PCT | USBPCR_TXPREEMPHTUNE |
> +	return USBPCR_SQRXTUNE_DCR_20PCT | USBPCR_TXPREEMPHTUNE |
>  		USBPCR_TXHSXVTUNE_DCR_15MV | USBPCR_TXVREFTUNE_INC_25PPT |
>  		USBPCR_COMMONONN | USBPCR_POR;
> -	writel(reg, priv->base + REG_USBPCR_OFFSET);

not a bug fix

>  }
>  
> -static void x1830_usb_phy_init(struct usb_phy *phy)
> +static u32 x1830_usb_phy_init(struct usb_phy *phy)

not a bug fix

>  {
>  	struct jz4770_phy *priv = phy_to_jz4770_phy(phy);
>  	u32 reg;
> @@ -246,9 +241,8 @@ static void x1830_usb_phy_init(struct usb_phy *phy)
>  		USBPCR1_DMPD | USBPCR1_DPPD;
>  	writel(reg, priv->base + REG_USBPCR1_OFFSET);
>  
> -	reg = USBPCR_IDPULLUP_OTG | USBPCR_VBUSVLDEXT |	USBPCR_TXPREEMPHTUNE |
> +	return USBPCR_IDPULLUP_OTG | USBPCR_VBUSVLDEXT | USBPCR_TXPREEMPHTUNE |
>  		USBPCR_COMMONONN | USBPCR_POR;
> -	writel(reg, priv->base + REG_USBPCR_OFFSET);

not a bug fix

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (858 bytes)