netdev - [v5.1] ucc_fast: Fix to avoid IS_ERR_VALUE abuses and dead code on 64bit systems.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1470329563-5464-1-git-send-email-arvind.yadav.cs@gmail.com>
Date:	Thu,  4 Aug 2016 22:22:43 +0530
From:	Arvind Yadav <arvind.yadav.cs@...il.com>
To:	zajec5@...il.com, leoli@...escale.com
Cc:	qiang.zhao@...escale.com, scottwood@...escale.com,
	viresh.kumar@...aro.org, akpm@...ux-foundation.org,
	linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
	linuxppc-dev@...ts.ozlabs.org, linux@...ck-us.net, arnd@...db.de,
	Arvind Yadav <arvind.yadav.cs@...il.com>
Subject: [v5.1] ucc_fast: Fix to avoid IS_ERR_VALUE abuses and dead code on 64bit systems.

IS_ERR_VALUE() assumes that parameter is an unsigned long.
It can not be used to check if 'unsigned int' is passed insted.
Which tends to reflect an error.
In 64bit architectures sizeof (int) == 4 && sizeof (long) == 8.
IS_ERR_VALUE(x) is ((x) >= (unsigned long)-4095).
IS_ERR_VALUE() of 'unsigned int' is always false because the 32bit
value is zero extended to 64 bits.

Now Problem In UCC fast protocols -: drivers/soc/fsl/qe/ucc_fast.c

        /* Allocate memory for Tx Virtual Fifo */
        uccf->ucc_fast_tx_virtual_fifo_base_offset =
          qe_muram_alloc(uf_info->utfs, UCC_FAST_VIRT_FIFO_REGS_ALIGNMENT);
        if (IS_ERR_VALUE(uccf->ucc_fast_tx_virtual_fifo_base_offset)) {
                printk(KERN_ERR "%s: cannot allocate MURAM for TX FIFO\n",
                        __func__);
                uccf->ucc_fast_tx_virtual_fifo_base_offset = 0;
                ucc_fast_free(uccf);
                return -ENOMEM;
        }

        /* Allocate memory for Rx Virtual Fifo */
        uccf->ucc_fast_rx_virtual_fifo_base_offset =
           qe_muram_alloc(uf_info->urfs +
                           UCC_FAST_RECEIVE_VIRTUAL_FIFO_SIZE_FUDGE_FACTOR,
                           UCC_FAST_VIRT_FIFO_REGS_ALIGNMENT);
        if (IS_ERR_VALUE(uccf->ucc_fast_rx_virtual_fifo_base_offset)) {
                printk(KERN_ERR "%s: cannot allocate MURAM for RX FIFO\n",
                        __func__);
                uccf->ucc_fast_rx_virtual_fifo_base_offset = 0;
                ucc_fast_free(uccf);
                return -ENOMEM;
        }

qe_muram_alloc (a.k.a. cpm_muram_alloc) returns unsigned long.
Return value store in a u32 (ucc_fast_tx_virtual_fifo_base_offset
and ucc_fast_rx_virtual_fifo_base_offset).If qe_muram_alloc will
return any error, Then IS_ERR_VALUE will always return 0. it'll not
call ucc_fast_free for any failure. Inside 'if code' will be a dead
code on 64bit.
This patch is to avoid this problem on 64bit machine.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@...il.com>
---
 include/soc/fsl/qe/ucc_fast.h | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/soc/fsl/qe/ucc_fast.h b/include/soc/fsl/qe/ucc_fast.h
index df8ea79..ada9070 100644
--- a/include/soc/fsl/qe/ucc_fast.h
+++ b/include/soc/fsl/qe/ucc_fast.h
@@ -165,10 +165,12 @@ struct ucc_fast_private {
 	int stopped_tx;		/* Whether channel has been stopped for Tx
 				   (STOP_TX, etc.) */
 	int stopped_rx;		/* Whether channel has been stopped for Rx */
-	u32 ucc_fast_tx_virtual_fifo_base_offset;/* pointer to base of Tx
-						    virtual fifo */
-	u32 ucc_fast_rx_virtual_fifo_base_offset;/* pointer to base of Rx
-						    virtual fifo */
+	unsigned long ucc_fast_tx_virtual_fifo_base_offset;/* pointer to base of
+							    * Tx virtual fifo
+							    */
+	unsigned long ucc_fast_rx_virtual_fifo_base_offset;/* pointer to base of
+							    * Rx virtual fifo
+							    */
 #ifdef STATISTICS
 	u32 tx_frames;		/* Transmitted frames counter. */
 	u32 rx_frames;		/* Received frames counter (only frames
-- 
1.9.1