linux-kernel - Re: [PATCH] usb: typec: mux: Fix matching with typec_altmode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 May 2021 12:13:46 +0300
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Bjorn Andersson <bjorn.andersson@...aro.org>
Cc:     Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jun Li <jun.li@....com>, Hans de Goede <hdegoede@...hat.com>,
        USB <linux-usb@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] usb: typec: mux: Fix matching with typec_altmode_desc

On Sun, May 16, 2021 at 6:47 AM Bjorn Andersson
<bjorn.andersson@...aro.org> wrote:
>
> In typec_mux_match() "nval" is assigned the number of elements in the
> "svid" fwnode property, then the variable is used to store the success
> of the read and finally attempts to loop between 0 and "success" - i.e.
> not at all - and the code returns indicating that no match was found.
>
> Fix this by using a separate variable to track the success of the read,
> to allow the loop to get a change to find a match.
>
> Fixes: 96a6d031ca99 ("usb: typec: mux: Find the muxes by also matching against the device node")
> Signed-off-by: Bjorn Andersson <bjorn.andersson@...aro.org>
> ---
>  drivers/usb/typec/mux.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c
> index 9da22ae3006c..8514bec7e1b8 100644
> --- a/drivers/usb/typec/mux.c
> +++ b/drivers/usb/typec/mux.c
> @@ -191,6 +191,7 @@ static void *typec_mux_match(struct fwnode_handle *fwnode, const char *id,
>         bool match;
>         int nval;
>         u16 *val;
> +       int ret;
>         int i;
>
>         /*
> @@ -218,10 +219,10 @@ static void *typec_mux_match(struct fwnode_handle *fwnode, const char *id,
>         if (!val)
>                 return ERR_PTR(-ENOMEM);
>
> -       nval = fwnode_property_read_u16_array(fwnode, "svid", val, nval);
> -       if (nval < 0) {
> +       ret = fwnode_property_read_u16_array(fwnode, "svid", val, nval);
> +       if (ret < 0) {
>                 kfree(val);
> -               return ERR_PTR(nval);
> +               return ERR_PTR(ret);
>         }

This changes the behaviour of the original code, i.e. nval can be
still positive but less than we got from previous call. Some fwnode
backends in some cases potentially can _successfully_ read less than
asked.

Perhaps

  nval = ret;

or drop the patch.

>         for (i = 0; i < nval; i++) {


-- 
With Best Regards,
Andy Shevchenko