linux-kernel - Re: [PATCH] i3c/master: Fix a potentially infinite loop in 'hci_dat_v1_get_index()'

Open Source and information security mailing list archives

Message-ID: <6s9184r-99rn-nr27-174s-r2nqn1o294n9@onlyvoer.pbz>
Date:   Fri, 19 Nov 2021 18:16:18 -0500 (EST)
From:   Nicolas Pitre <npitre@...libre.com>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
cc:     alexandre.belloni@...tlin.com, boris.brezillon@...labora.com,
        linux-i3c@...ts.infradead.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] i3c/master: Fix a potentially infinite loop in
 'hci_dat_v1_get_index()'

On Wed, 17 Nov 2021, Christophe JAILLET wrote:

> The code in 'hci_dat_v1_get_index()' really looks like a hand coded version
> of 'for_each_set_bit()', except that a +1 is missing when searching for the
> next set bit.
> 
> This really looks odd and it seems that it will loop until 'dat_w0_read()'
> returns the expected result.
> 
> So use 'for_each_set_bit()' instead. It is less verbose and should be more
> correct.
> 
> Fixes: 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>

Acked-by: Nicolas Pitre <npitre@...libre.com>

> ---
> Speculative fix. Untested.
> ---
>  drivers/i3c/master/mipi-i3c-hci/dat_v1.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/drivers/i3c/master/mipi-i3c-hci/dat_v1.c b/drivers/i3c/master/mipi-i3c-hci/dat_v1.c
> index 783e551a2c85..97bb49ff5b53 100644
> --- a/drivers/i3c/master/mipi-i3c-hci/dat_v1.c
> +++ b/drivers/i3c/master/mipi-i3c-hci/dat_v1.c
> @@ -160,9 +160,7 @@ static int hci_dat_v1_get_index(struct i3c_hci *hci, u8 dev_addr)
>  	unsigned int dat_idx;
>  	u32 dat_w0;
>  
> -	for (dat_idx = find_first_bit(hci->DAT_data, hci->DAT_entries);
> -	     dat_idx < hci->DAT_entries;
> -	     dat_idx = find_next_bit(hci->DAT_data, hci->DAT_entries, dat_idx)) {
> +	for_each_set_bit(dat_idx, hci->DAT_data, hci->DAT_entries) {
>  		dat_w0 = dat_w0_read(dat_idx);
>  		if (FIELD_GET(DAT_0_DYNAMIC_ADDRESS, dat_w0) == dev_addr)
>  			return dat_idx;
> -- 
> 2.30.2
> 
> 
> -- 
> linux-i3c mailing list
> linux-i3c@...ts.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-i3c
> 

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives