| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 15 Dec 2023 14:59:35 +0100
From: Francesco Dolcini <francesco@...cini.it>
To: Johan Hovold <johan@...nel.org>
Cc: Francesco Dolcini <francesco@...cini.it>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Jiri Slaby <jirislaby@...nel.org>, linux-bluetooth@...r.kernel.org,
linux-mediatek@...ts.infradead.org, linux-kernel@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, greybus-dev@...ts.linaro.org,
linux-iio@...r.kernel.org, netdev@...r.kernel.org,
chrome-platform@...ts.linux.dev,
platform-driver-x86@...r.kernel.org, linux-serial@...r.kernel.org,
linux-sound@...r.kernel.org,
Francesco Dolcini <francesco.dolcini@...adex.com>,
Luiz Augusto von Dentz <luiz.dentz@...il.com>,
Alex Elder <elder@...nel.org>, Jonathan Cameron <jic23@...nel.org>,
Lee Jones <lee@...nel.org>, Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>,
"David S. Miller" <davem@...emloft.net>,
Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>,
Hans de Goede <hdegoede@...hat.com>,
Ilpo Järvinen <ilpo.jarvinen@...ux.intel.com>,
Benson Leung <bleung@...omium.org>,
Tzung-Bi Shih <tzungbi@...nel.org>, Rob Herring <robh@...nel.org>
Subject: Re: [PATCH v1] treewide, serdev: change receive_buf() return type to
size_t
On Fri, Dec 15, 2023 at 02:51:09PM +0100, Johan Hovold wrote:
> On Thu, Dec 14, 2023 at 06:01:46PM +0100, Francesco Dolcini wrote:
> > From: Francesco Dolcini <francesco.dolcini@...adex.com>
> >
> > receive_buf() is called from ttyport_receive_buf() that expects values
> > ">= 0" from serdev_controller_receive_buf(), change its return type from
> > ssize_t to size_t.
> >
> > Suggested-by: Jiri Slaby <jirislaby@...nel.org>
> > Link: https://lore.kernel.org/all/087be419-ec6b-47ad-851a-5e1e3ea5cfcc@kernel.org/
> > Signed-off-by: Francesco Dolcini <francesco.dolcini@...adex.com>
> > ---
> > hello,
> > patch is based on current linux next.
> >
> > It has an obvious problem, it touches files from multiple subsystem in a single
> > patch that is complicated to review and eventually merge, just splitting this
> > would however not work, it will break bisectability and the build.
> >
> > I am looking for advise on the best way to move forward.
> >
> > I see the following options:
> > - keep it as it is
> > - break it down with a patch with each subsystem, and squash before applying
> > from a single (tty?) subsystem
> > - go for a multi stage approach, defining a new callback, move to it and in
> > the end remove the original one, likewise it was done for i2c lately
> >
> > ---
> > drivers/bluetooth/btmtkuart.c | 4 ++--
> > drivers/bluetooth/btnxpuart.c | 4 ++--
>
> > diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
> > index 3c84fcbda01a..e6bc4a73c9fc 100644
> > --- a/drivers/bluetooth/btmtkuart.c
> > +++ b/drivers/bluetooth/btmtkuart.c
> > @@ -383,8 +383,8 @@ static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
> > }
> > }
> >
> > -static ssize_t btmtkuart_receive_buf(struct serdev_device *serdev,
> > - const u8 *data, size_t count)
> > +static size_t btmtkuart_receive_buf(struct serdev_device *serdev,
> > + const u8 *data, size_t count)
> > {
> > struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev);
> >
> > diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> > index 1d592ac413d1..056bef5b2919 100644
> > --- a/drivers/bluetooth/btnxpuart.c
> > +++ b/drivers/bluetooth/btnxpuart.c
> > @@ -1264,8 +1264,8 @@ static const struct h4_recv_pkt nxp_recv_pkts[] = {
> > { NXP_RECV_FW_REQ_V3, .recv = nxp_recv_fw_req_v3 },
> > };
> >
> > -static ssize_t btnxpuart_receive_buf(struct serdev_device *serdev,
> > - const u8 *data, size_t count)
> > +static size_t btnxpuart_receive_buf(struct serdev_device *serdev,
> > + const u8 *data, size_t count)
> > {
> > struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
>
> A quick check of just the first two functions here shows that they can
> return negative values.
This is already fixed. Patches are in next.
There were 3 buggy user of this API.
- 1 patch was merged a few days ago in mainline
- 2 patches are in next, the maintainer decided to wait for the next merge window
commit 687d2de93b11 ("Bluetooth: btmtkuart: fix recv_buf() return value")
commit 7954bbcdd7ea ("Bluetooth: btnxpuart: fix recv_buf() return value")
commit c8820c92caf0 ("platform/surface: aggregator: fix recv_buf() return value")
>
> > diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
> > index e94e090cf0a1..3d7ae7fa5018 100644
> > --- a/drivers/tty/serdev/serdev-ttyport.c
> > +++ b/drivers/tty/serdev/serdev-ttyport.c
> > @@ -27,19 +27,17 @@ static size_t ttyport_receive_buf(struct tty_port *port, const u8 *cp,
> > {
> > struct serdev_controller *ctrl = port->client_data;
> > struct serport *serport = serdev_controller_get_drvdata(ctrl);
> > - int ret;
> > + size_t ret;
> >
> > if (!test_bit(SERPORT_ACTIVE, &serport->flags))
> > return 0;
> >
> > ret = serdev_controller_receive_buf(ctrl, cp, count);
> >
> > - dev_WARN_ONCE(&ctrl->dev, ret < 0 || ret > count,
> > - "receive_buf returns %d (count = %zu)\n",
> > + dev_WARN_ONCE(&ctrl->dev, ret > count,
> > + "receive_buf returns %zu (count = %zu)\n",
> > ret, count);
> > - if (ret < 0)
> > - return 0;
> > - else if (ret > count)
> > + if (ret > count)
> > return count;
> >
> > return ret;
>
> So please do not apply this patch until the various implementations have
> been fixed.
>
> Johan
Powered by blists - more mailing lists