linux-kernel - Re: [PATCH 1/1] USB: PHY: JZ4770: Fix uninitialized value written to HW register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <PN4QFQ.KWNBY2ZWQ7XC2@crapouillou.net>
Date:   Thu, 27 Aug 2020 15:11:49 +0200
From:   Paul Cercueil <paul@...pouillou.net>
To:     Felipe Balbi <balbi@...nel.org>
Cc:     周琰杰 <zhouyanjie@...yeetech.com>,
        周正 <sernia.zhou@...mail.com>,
        漆鹏振 <aric.pzqi@...enic.com>, od@...c.me,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] USB: PHY: JZ4770: Fix uninitialized value written to
 HW register

Hi Felipe,

Le jeu. 27 août 2020 à 15:58, Felipe Balbi <balbi@...nel.org> a 
écrit :
> 
> Hi,
> 
> Paul Cercueil <paul@...pouillou.net> writes:
>>  The 'reg' value was written to a hardware register in
>>  ingenic_usb_phy_init(), while not being initialized anywhere.
> 
> your patch does a lot more than fix the bug :-)
> 
>>  Fixes: 2a6c0b82e651 ("USB: PHY: JZ4770: Add support for new Ingenic 
>> SoCs.")
>>  Signed-off-by: Paul Cercueil <paul@...pouillou.net>
>>  ---
>>   drivers/usb/phy/phy-jz4770.c | 28 +++++++++++-----------------
>>   1 file changed, 11 insertions(+), 17 deletions(-)
>> 
>>  diff --git a/drivers/usb/phy/phy-jz4770.c 
>> b/drivers/usb/phy/phy-jz4770.c
>>  index d4ee3cb721ea..58771a8688f2 100644
>>  --- a/drivers/usb/phy/phy-jz4770.c
>>  +++ b/drivers/usb/phy/phy-jz4770.c
>>  @@ -97,7 +97,7 @@ enum ingenic_usb_phy_version {
>>   struct ingenic_soc_info {
>>   	enum ingenic_usb_phy_version version;
>> 
>>  -	void (*usb_phy_init)(struct usb_phy *phy);
>>  +	u32 (*usb_phy_init)(struct usb_phy *phy);
> 
> this is not fixing any bug
> 
>>  @@ -172,7 +172,8 @@ static int ingenic_usb_phy_init(struct usb_phy 
>> *phy)
>>   		return err;
>>   	}
>> 
>>  -	priv->soc_info->usb_phy_init(phy);
>>  +	reg = priv->soc_info->usb_phy_init(phy);
>>  +	writel(reg, priv->base + REG_USBPCR_OFFSET);
> 
> not fixing any bug.
> 
> Looking at the code, the bug follows after this line. It would suffice
> to read REG_USBPCR_OFFSET in order to initialize reg. This bug fix 
> could
> have been a one liner.

There's no need to re-read a register when you have the value readily 
available. It just needs to be returned from the usb_phy_init 
callbacks. But yes, it's not a one-liner.

> 
>>  @@ -195,19 +196,15 @@ static void ingenic_usb_phy_remove(void *phy)
>>   	usb_remove_phy(phy);
>>   }
>> 
>>  -static void jz4770_usb_phy_init(struct usb_phy *phy)
>>  +static u32 jz4770_usb_phy_init(struct usb_phy *phy)
> 
> not a bug fix
> 
>>   {
>>  -	struct jz4770_phy *priv = phy_to_jz4770_phy(phy);
>>  -	u32 reg;
>>  -
>>  -	reg = USBPCR_AVLD_REG | USBPCR_COMMONONN | USBPCR_IDPULLUP_ALWAYS 
>> |
>>  +	return USBPCR_AVLD_REG | USBPCR_COMMONONN | 
>> USBPCR_IDPULLUP_ALWAYS |
>>   		USBPCR_COMPDISTUNE_DFT | USBPCR_OTGTUNE_DFT | 
>> USBPCR_SQRXTUNE_DFT |
>>   		USBPCR_TXFSLSTUNE_DFT | USBPCR_TXRISETUNE_DFT | 
>> USBPCR_TXVREFTUNE_DFT |
>>   		USBPCR_POR;
>>  -	writel(reg, priv->base + REG_USBPCR_OFFSET);
> 
> not a bug fix
> 
>>   }
>> 
>>  -static void jz4780_usb_phy_init(struct usb_phy *phy)
>>  +static u32 jz4780_usb_phy_init(struct usb_phy *phy)
> 
> not a bug fix
> 
>>  @@ -216,11 +213,10 @@ static void jz4780_usb_phy_init(struct 
>> usb_phy *phy)
>>   		USBPCR1_WORD_IF_16BIT;
>>   	writel(reg, priv->base + REG_USBPCR1_OFFSET);
>> 
>>  -	reg = USBPCR_TXPREEMPHTUNE | USBPCR_COMMONONN | USBPCR_POR;
>>  -	writel(reg, priv->base + REG_USBPCR_OFFSET);
>>  +	return USBPCR_TXPREEMPHTUNE | USBPCR_COMMONONN | USBPCR_POR;
> 
> not a bug fix
> 
>>   }
>> 
>>  -static void x1000_usb_phy_init(struct usb_phy *phy)
>>  +static u32 x1000_usb_phy_init(struct usb_phy *phy)
> 
> not a bug fix
> 
>>   {
>>   	struct jz4770_phy *priv = phy_to_jz4770_phy(phy);
>>   	u32 reg;
>>  @@ -228,13 +224,12 @@ static void x1000_usb_phy_init(struct usb_phy 
>> *phy)
>>   	reg = readl(priv->base + REG_USBPCR1_OFFSET) | 
>> USBPCR1_WORD_IF_16BIT;
>>   	writel(reg, priv->base + REG_USBPCR1_OFFSET);
>> 
>>  -	reg = USBPCR_SQRXTUNE_DCR_20PCT | USBPCR_TXPREEMPHTUNE |
>>  +	return USBPCR_SQRXTUNE_DCR_20PCT | USBPCR_TXPREEMPHTUNE |
>>   		USBPCR_TXHSXVTUNE_DCR_15MV | USBPCR_TXVREFTUNE_INC_25PPT |
>>   		USBPCR_COMMONONN | USBPCR_POR;
>>  -	writel(reg, priv->base + REG_USBPCR_OFFSET);
> 
> not a bug fix
> 
>>   }
>> 
>>  -static void x1830_usb_phy_init(struct usb_phy *phy)
>>  +static u32 x1830_usb_phy_init(struct usb_phy *phy)
> 
> not a bug fix
> 
>>   {
>>   	struct jz4770_phy *priv = phy_to_jz4770_phy(phy);
>>   	u32 reg;
>>  @@ -246,9 +241,8 @@ static void x1830_usb_phy_init(struct usb_phy 
>> *phy)
>>   		USBPCR1_DMPD | USBPCR1_DPPD;
>>   	writel(reg, priv->base + REG_USBPCR1_OFFSET);
>> 
>>  -	reg = USBPCR_IDPULLUP_OTG | USBPCR_VBUSVLDEXT 
>> |	USBPCR_TXPREEMPHTUNE |
>>  +	return USBPCR_IDPULLUP_OTG | USBPCR_VBUSVLDEXT | 
>> USBPCR_TXPREEMPHTUNE |
>>   		USBPCR_COMMONONN | USBPCR_POR;
>>  -	writel(reg, priv->base + REG_USBPCR_OFFSET);
> 
> not a bug fix

Well, if you don't like my bug fix, next time wait for my Reviewed-by.

Cheers,
-Paul