linux-kernel - Re: [PATCH v1 2/7] fpga: dfl: check feature type before parse irq info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 15 Feb 2022 06:49:05 -0800
From:   Tom Rix <trix@...hat.com>
To:     Tianfei zhang <tianfei.zhang@...el.com>, hao.wu@...el.com,
        mdf@...nel.org, yilun.xu@...el.com, linux-fpga@...r.kernel.org,
        linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     corbet@....net
Subject: Re: [PATCH v1 2/7] fpga: dfl: check feature type before parse irq
 info


On 2/14/22 3:26 AM, Tianfei zhang wrote:
> From: Tianfei Zhang <tianfei.zhang@...el.com>
>
> The feature ID of "Port User Interrupt" and the
> "PMCI Subsystem" are identical, 0x12, but one is for FME,
> other is for Port. It should check the feature type While
> parsing the irq info in parse_feature_irqs().

This seems like a bug fix and not part of iofs feature.

Split this out of the patchset.

This is a workaround a hardware problem, there should be some comments 
to the effect that you can't trust _this_ or _that_ feature id and some 
special handling earlier.

The ambiguity of feature id is a problem, and this sort of bug will 
happen again.

What can be done to prevent this in the future ?

>
> Signed-off-by: Tianfei Zhang <tianfei.zhang@...el.com>
> ---
>   drivers/fpga/dfl.c | 11 +++++++++++
>   1 file changed, 11 insertions(+)
>
> diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
> index 599bb21d86af..26f8cf890700 100644
> --- a/drivers/fpga/dfl.c
> +++ b/drivers/fpga/dfl.c
> @@ -940,9 +940,14 @@ static int parse_feature_irqs(struct build_feature_devs_info *binfo,
>   {
>   	void __iomem *base = binfo->ioaddr + ofst;
>   	unsigned int i, ibase, inr = 0;
> +	enum dfl_id_type type;
>   	int virq;
>   	u64 v;
>   
> +	type = feature_dev_id_type(binfo->feature_dev);
> +	if (type >= DFL_ID_MAX)
> +		return -EINVAL;
> +
>   	/*
>   	 * Ideally DFL framework should only read info from DFL header, but
>   	 * current version DFL only provides mmio resources information for
> @@ -959,16 +964,22 @@ static int parse_feature_irqs(struct build_feature_devs_info *binfo,
>   	 */
>   	switch (fid) {
>   	case PORT_FEATURE_ID_UINT:
> +		if (type != PORT_ID)
> +			break;

Instead of embedding a break in the switch, break the switch into fme 
switch and port switch

if (type == PORT_ID)

   port-switch

else if (type == FME_ID

   fme-switch

Tom

>   		v = readq(base + PORT_UINT_CAP);
>   		ibase = FIELD_GET(PORT_UINT_CAP_FST_VECT, v);
>   		inr = FIELD_GET(PORT_UINT_CAP_INT_NUM, v);
>   		break;
>   	case PORT_FEATURE_ID_ERROR:
> +		if (type != PORT_ID)
> +			break;
>   		v = readq(base + PORT_ERROR_CAP);
>   		ibase = FIELD_GET(PORT_ERROR_CAP_INT_VECT, v);
>   		inr = FIELD_GET(PORT_ERROR_CAP_SUPP_INT, v);
>   		break;
>   	case FME_FEATURE_ID_GLOBAL_ERR:
> +		if (type != FME_ID)
> +			break;
>   		v = readq(base + FME_ERROR_CAP);
>   		ibase = FIELD_GET(FME_ERROR_CAP_INT_VECT, v);
>   		inr = FIELD_GET(FME_ERROR_CAP_SUPP_INT, v);