linux-kernel - Re: [PATCH v3 1/6] regulator: core: validate selector against linear_min

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <756a43cf-b7b5-d8a2-ae5c-89bdc3eb26ba@microchip.com>
Date:   Wed, 25 Nov 2020 10:46:48 +0000
From:   <Claudiu.Beznea@...rochip.com>
To:     <jonathanh@...dia.com>, <lgirdwood@...il.com>, <broonie@...nel.org>
CC:     <s.hauer@...gutronix.de>, <ttynkkynen@...dia.com>,
        <linus.walleij@...aro.org>, <axel.lin@...ics.com>,
        <linux-kernel@...r.kernel.org>,
        <linux-arm-kernel@...ts.infradead.org>,
        <linux-tegra@...r.kernel.org>
Subject: Re: [PATCH v3 1/6] regulator: core: validate selector against
 linear_min_sel

On 24.11.2020 15:41, Jon Hunter wrote:
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
> 
> On 24/11/2020 11:14, Claudiu.Beznea@...rochip.com wrote:
> 
> ...
> 
>> I would say that a solution would be to have a new helper to retrieve the
>> linear_min_sel (e.g. regulator_min_sel()) and use this for all the
>> consumers of regulator_list_voltage() and the other APIs that patch
>> "regulator: core: validate selector against linear_min_sel" has changed
>> (regulator_list_voltage_table(), regulator_set_voltage_time()). With this
>> change the loop in find_vdd_map_entry_exact() should be b/w
>> regulator_min_sel() and regulator_count_voltages().
>>
>> Maybe Mark has a better solution for this.
> 
> 
> By the way, I don't think that Tegra is alone here. I see some other
> drivers doing some similar things [0][1][2] and so I am wondering if
> this is going to be a problem for a few drivers.
> 

As far as I can tell most of the regulator_list_voltage() consumers are
checking the return value against a [min_uV, max_uV] range or if the return
value is a negative error code or zero. The consumers are looking a
selector that respect the above rule for the entire [0,
regulator_count_voltages()] range (I have to double check for the rest of
functions modified by my patch). In case of clk-dfll.c the
find_vdd_map_entry_exact() returns if it finds the 1st invalid selector:

	n_voltages = regulator_count_voltages(td->vdd_reg);
	for (i = 0; i < n_voltages; i++) {
		reg_uV = regulator_list_voltage(td->vdd_reg, i);
		if (reg_uV < 0)
			break;

		reg_volt_id = reg_uV / td->soc->alignment.step_uv;

		if (align_step == reg_volt_id)
			return i;
	}

Maybe it would be better if the loop continues in case reg_uV is negative
or zero? (the zero case is good for this function as it will make the
(align_step == reg_volt_id) to be false). But as Mark said in the previous
email, there could be regulators with gaps in between min_sel and n_voltages.

With the previous code it seems it worked because the
regulator_list_voltage() calls the as3722's list_voltage which is
regulator_list_voltage_linear() which checks the selector against
min_selector and returns zero in case the selector is lower than the
min_selector. Please correct me if I'm wrong.

Anyway, I will prepare a fix for my previous patch to return zero in case
the regulator_count_voltages() receives an invalid selector. That should
also fix the case with this driver.

Thank you,
Claudiu

> Jon
> 
> [0]
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/mmc/core/regulator.c#n61
> [1]
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/cpufreq/s3c2416-cpufreq.c#n263
> [2]
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/leds/leds-regulator.c#n29
> 
> --
> nvpublic
>