LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Phillip Potter <phil@philpotter.co.uk>
To: Pavel Skripkin <paskripkin@gmail.com>
Cc: Larry Finger <Larry.Finger@lwfinger.net>,
	Greg KH <gregkh@linuxfoundation.org>,
	Michael Straube <straube.linux@gmail.com>,
	"Fabio M. De Francesco" <fmdefrancesco@gmail.com>,
	"open list:STAGING SUBSYSTEM" <linux-staging@lists.linux.dev>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH RFC v2 5/6] staging: r8188eu: add error handling of rtw_read32
Date: Tue, 24 Aug 2021 00:33:46 +0100	[thread overview]
Message-ID: <CAA=Fs0=gX66TW3qoHYWcoSsvai6YZn=U81a34V45oij7NrMJrQ@mail.gmail.com> (raw)
In-Reply-To: <9004eb2972780455db4cba9694244a2c572abba8.1629642658.git.paskripkin@gmail.com>

On Sun, 22 Aug 2021 at 15:36, Pavel Skripkin <paskripkin@gmail.com> wrote:
> -static u32 usb_read32(struct intf_hdl *pintfhdl, u32 addr)
> +static int usb_read32(struct intf_hdl *pintfhdl, u32 addr, u32 *data)
>  {
>         u8 requesttype;
>         u16 wvalue;
>         u16 len;
> -       __le32 data;
> +       int res;
> +       __le32 tmp;
> +
> +       if (WARN_ON(unlikely(!data)))
> +               return -EINVAL;
>
>         requesttype = 0x01;/* read_in */
>
>         wvalue = (u16)(addr & 0x0000ffff);
>         len = 4;
>
> -       usbctrl_vendorreq(pintfhdl, wvalue, &data, len, requesttype);
> +       res = usbctrl_vendorreq(pintfhdl, wvalue, &data, len, requesttype);
> +       if (res < 0) {
> +               dev_err(dvobj_to_dev(pintfhdl->pintf_dev), "Failed to read 32 bytes: %d\n", res);
> +       } else {
> +               /* Noone cares about positive return value */
> +               *data = le32_to_cpu(tmp);
> +               res = 0;
> +       }
>
> -       return le32_to_cpu(data);
> +       return res;
>  }

Dear Pavel,

OK, found the issue with decoded stack trace after reviewing this
usb_read32 function. Your line:
res = usbctrl_vendorreq(pintfhdl, wvalue, &data, len, requesttype);

should read:
res = usbctrl_vendorreq(pintfhdl, wvalue, &tmp, len, requesttype);

With this change, the driver runs fine with no crashes/oopses. I will
explain the issue but you can probably see already, so I hope I'm not
coming across as patronising, just trying to be helpful :-)

Essentially, you are taking the address of the data function parameter
on this line with &data, a pointer to u32, which is giving you a
pointer to a pointer to u32 (u32 **) for this function parameter
variable. When passed to usbctrl_vendorreq, it is being passed to
memcpy inside this function as a void *, meaning that memcpy
subsequently overwrites the value of the memory address inside data to
point to a different location, which is problem when it is later
deferenced at:
*data = le32_to_cpu(tmp);
causing the OOPS

Also, as written, you can probably see that tmp is uninitialised. This
looks like a typo, so guessing this wasn't your intention. Anyhow,
with that small change, usbctrl_vendorreq reads into tmp, which is
then passed to le32_to_cpu whose return value is stored via the
deferenced data ptr (which now has its original address within and not
inadvertently modified). Hope this helps, and I'd be happy to Ack the
series if you want to resend this patch. Many thanks.

Regards,
Phil

  reply	other threads:[~2021-08-23 23:34 UTC|newest]

Thread overview: 118+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-20 17:07 [PATCH RFC 0/3] staging: r8188eu: avoid uninit value bugs Pavel Skripkin
2021-08-20 17:07 ` [PATCH RFC 1/3] staging: r8188eu: add proper rtw_read* error handling Pavel Skripkin
2021-08-20 21:50   ` Pavel Skripkin
2021-08-20 23:41   ` Phillip Potter
2021-08-21  5:55   ` Fabio M. De Francesco
2021-08-21 10:35     ` Pavel Skripkin
2021-08-21 12:11       ` Fabio M. De Francesco
2021-08-20 17:07 ` [PATCH RFC 2/3] staging: r8188eu: add error handling to ReadFuse Pavel Skripkin
2021-08-20 23:51   ` Phillip Potter
2021-08-21  3:59     ` Fabio M. De Francesco
2021-08-20 17:07 ` [PATCH RFC 3/3] staging: r8188eu: add error argument to read_macreg Pavel Skripkin
2021-08-20 23:18   ` Phillip Potter
2021-08-21 10:38     ` Pavel Skripkin
2021-08-20 23:12 ` [PATCH RFC 0/3] staging: r8188eu: avoid uninit value bugs Phillip Potter
2021-08-21 10:42   ` Pavel Skripkin
2021-08-22  9:53 ` Fabio M. De Francesco
2021-08-22 10:09   ` Pavel Skripkin
2021-08-22 10:59     ` Fabio M. De Francesco
2021-08-22 11:34       ` Fabio M. De Francesco
2021-08-22 12:10       ` Pavel Skripkin
2021-08-22 12:39         ` Greg KH
2021-08-22 12:50           ` Pavel Skripkin
2021-08-22 13:06             ` Greg KH
2021-08-22 13:21           ` Fabio M. De Francesco
2021-08-22 13:30             ` Greg KH
2021-08-22 13:31             ` Pavel Skripkin
2021-08-22 14:35               ` [PATCH RFC v2 0/6] " Pavel Skripkin
2021-08-22 14:35                 ` [PATCH RFC v2 1/6] staging: r8188eu: remove {read,write}_macreg Pavel Skripkin
2021-08-22 14:35                 ` [PATCH RFC v2 2/6] staging: r8188eu: add helper macro for printing registers Pavel Skripkin
2021-08-22 14:35                 ` [PATCH RFC v2 3/6] staging: r8188eu: add error handling of rtw_read8 Pavel Skripkin
2021-08-22 14:35                 ` [PATCH RFC v2 4/6] staging: r8188eu: add error handling of rtw_read16 Pavel Skripkin
2021-08-22 14:36                 ` [PATCH RFC v2 5/6] staging: r8188eu: add error handling of rtw_read32 Pavel Skripkin
2021-08-23 23:33                   ` Phillip Potter [this message]
2021-08-24  0:10                     ` Fabio M. De Francesco
2021-08-24  6:40                       ` Pavel Skripkin
2021-08-24  8:38                         ` Fabio M. De Francesco
2021-08-24  8:47                           ` Pavel Skripkin
2021-08-24  8:53                             ` Pavel Skripkin
2021-08-24  9:46                               ` Fabio M. De Francesco
2021-08-24 22:10                               ` Phillip Potter
2021-08-24 22:07                             ` Phillip Potter
2021-08-24  6:53                     ` Pavel Skripkin
2021-08-24  7:25                     ` [PATCH v3 0/6] staging: r8188eu: avoid uninit value bugs Pavel Skripkin
2021-08-24  7:27                       ` [PATCH v3 1/6] staging: r8188eu: remove {read,write}_macreg Pavel Skripkin
2021-08-26 10:39                         ` Greg KH
2021-08-26 10:40                         ` Greg KH
2021-08-24  7:27                       ` [PATCH v3 2/6] staging: r8188eu: add helper macro for printing registers Pavel Skripkin
2021-08-26 10:37                         ` Greg KH
2021-08-24  7:27                       ` [PATCH v3 3/6] staging: r8188eu: add error handling of rtw_read8 Pavel Skripkin
2021-08-25 12:05                         ` kernel test robot
2021-08-25 12:17                           ` Pavel Skripkin
2021-08-25 12:51                             ` Dan Carpenter
2021-08-25 13:02                               ` Pavel Skripkin
2021-08-25 13:34                                 ` Dan Carpenter
2021-08-25 13:44                                   ` Pavel Skripkin
2021-08-25 17:11                                     ` Nick Desaulniers
2021-08-26 11:08                                       ` Dan Carpenter
2021-08-25 23:45                         ` Fabio M. De Francesco
2021-08-26  5:13                           ` Pavel Skripkin
2021-08-26  8:21                         ` David Laight
2021-08-26  8:27                           ` Pavel Skripkin
2021-08-26 10:19                             ` David Laight
2021-08-26 11:21                               ` Dan Carpenter
2021-08-27  8:14                                 ` David Laight
2021-08-27  8:22                                   ` Pavel Skripkin
2021-08-27  9:07                         ` Dan Carpenter
2021-08-27  9:16                           ` Pavel Skripkin
2021-08-27  9:23                             ` Dan Carpenter
2021-08-30 11:21                         ` kernel test robot
2021-08-24  7:27                       ` [PATCH v3 4/6] staging: r8188eu: add error handling of rtw_read16 Pavel Skripkin
2021-08-25  4:35                         ` Fabio M. De Francesco
2021-08-25  8:22                           ` Pavel Skripkin
2021-08-25  9:48                             ` Fabio M. De Francesco
2021-08-25  9:55                               ` Pavel Skripkin
2021-08-25 10:06                                 ` Dan Carpenter
2021-08-25 10:13                                   ` Pavel Skripkin
2021-08-25 10:38                                     ` Dan Carpenter
2021-08-25 10:41                                       ` Pavel Skripkin
2021-08-25 11:06                                       ` Fabio M. De Francesco
2021-08-25 11:11                                         ` Fabio M. De Francesco
2021-08-25 11:31                                         ` Dan Carpenter
2021-08-25 12:11                                           ` Fabio M. De Francesco
2021-08-25 10:51                                 ` Fabio M. De Francesco
2021-08-26 10:50                         ` Greg KH
2021-08-26 10:58                           ` Pavel Skripkin
2021-08-24  7:27                       ` [PATCH v3 5/6] staging: r8188eu: add error handling of rtw_read32 Pavel Skripkin
2021-08-25  4:40                         ` Fabio M. De Francesco
2021-08-26  8:51                         ` David Laight
2021-08-26  9:22                           ` Pavel Skripkin
2021-08-26  9:27                             ` Pavel Skripkin
2021-08-26 10:22                               ` David Laight
2021-08-26 10:55                                 ` Pavel Skripkin
2021-08-26 10:59                                   ` David Laight
2021-08-26 20:03                                     ` Pavel Skripkin
2021-08-27  7:12                                       ` gregkh
2021-08-27  7:16                                         ` Pavel Skripkin
2021-08-24  7:27                       ` [PATCH v3 6/6] staging: r8188eu: make ReadEFuse return an int Pavel Skripkin
2021-08-25 10:13                       ` [PATCH v3 0/6] staging: r8188eu: avoid uninit value bugs Fabio M. De Francesco
2021-08-27  7:49                       ` Kari Argillander
2021-08-27  7:52                         ` Pavel Skripkin
2021-08-24  6:58                   ` [PATCH RFC v2 5/6] staging: r8188eu: add error handling of rtw_read32 Dan Carpenter
2021-08-24  7:01                     ` Pavel Skripkin
2021-08-24 15:07                       ` Fabio M. De Francesco
2021-08-22 14:36                 ` [PATCH RFC v2 6/6] staging: r8188eu: make ReadEFuse return an int Pavel Skripkin
2021-08-22 15:30                 ` [PATCH RFC v2 0/6] staging: r8188eu: avoid uninit value bugs Pavel Skripkin
2021-08-22 16:05                   ` Michael Straube
2021-08-22 16:26                     ` Pavel Skripkin
2021-08-22 23:52                       ` Phillip Potter
2021-08-22 17:36                 ` Fabio M. De Francesco
2021-08-22 17:38                   ` Pavel Skripkin
2021-08-22 20:06                     ` Fabio M. De Francesco
2021-08-22 20:19                       ` Pavel Skripkin
2021-08-23  0:12                 ` Phillip Potter
2021-08-23  6:38                   ` Pavel Skripkin
2021-08-23  6:44                   ` Pavel Skripkin
2021-08-22 16:03               ` [PATCH RFC 0/3] " Fabio M. De Francesco
2021-08-22 16:15                 ` Pavel Skripkin
2021-08-22 15:04             ` Phillip Potter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAA=Fs0=gX66TW3qoHYWcoSsvai6YZn=U81a34V45oij7NrMJrQ@mail.gmail.com' \
    --to=phil@philpotter.co.uk \
    --cc=Larry.Finger@lwfinger.net \
    --cc=fmdefrancesco@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-staging@lists.linux.dev \
    --cc=paskripkin@gmail.com \
    --cc=straube.linux@gmail.com \
    --subject='Re: [PATCH RFC v2 5/6] staging: r8188eu: add error handling of rtw_read32' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).