On Wed, Jul 17, 2019 at 11:16 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Tue, Jul 16, 2019 at 11:52:19PM +0200, Linus Walleij wrote:
> > On Wed, Jul 10, 2019 at 1:07 PM syzbot
> > <syzbot+cf35b76f35e068a1107f@syzkaller.appspotmail.com> wrote:
> >
> > > HEAD commit:    7829a896 usb-fuzzer: main usb gadget fuzzer driver
> > (...)
> > >   __gpio_set_value include/asm-generic/gpio.h:104 [inline]
> > >   gpio_set_value include/linux/gpio.h:71 [inline]
> > >   nfcmrvl_chip_halt+0x4e/0x70 drivers/nfc/nfcmrvl/main.c:259
> > >   nfcmrvl_nci_register_dev+0x2d4/0x378 drivers/nfc/nfcmrvl/main.c:176
> > >   nfcmrvl_probe+0x4e9/0x5e0 drivers/nfc/nfcmrvl/usb.c:344
> >
> > This bug is somewhere in the drivers/nfc/nfcmrvl* code handling
> > GPIOs.
>
> Right, and it's my bug.
>
> > It should be converted to GPIO descriptors and fixed up, see
> > drivers/gpio/TODO for details on how to do this.
>
> Conversion will have to wait, let's fix the regression first. :)
>
> > Johan/Vincent, tell me if you want me to forward the full fuzzing
> > robot crash dump.
>
> No need, thanks. I got it the report.
>
> Something like the below compiles and should fix it. Vacation starts
> today so I'll revisit and send a proper patch in a couple of weeks.
>
> Perhaps someone can feed it to the bot meanwhile (no time to play with
> it right now).

#syz test: https://github.com/google/kasan.git usb-fuzzer

>
> Note that this issue has been there since 4.12, so guess no one uses
> these devices...
>
> Johan
>
>
> From e9d9d0ef5ffd6b306cffb2f4e2514f503aa626a5 Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Wed, 17 Jul 2019 11:07:13 +0200
> Subject: [PATCH] NFC: nfcmrvl: fix gpio-handling regression
>
> FIXME
>
> Fixes: e33a3f84f88f ("NFC: nfcmrvl: allow gpio 0 for reset signalling")
> Not-Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>  drivers/nfc/nfcmrvl/main.c | 4 ++--
>  drivers/nfc/nfcmrvl/usb.c  | 1 +
>  2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c
> index e65d027b91fa..529be35ac178 100644
> --- a/drivers/nfc/nfcmrvl/main.c
> +++ b/drivers/nfc/nfcmrvl/main.c
> @@ -244,7 +244,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
>         /* Reset possible fault of previous session */
>         clear_bit(NFCMRVL_PHY_ERROR, &priv->flags);
>
> -       if (priv->config.reset_n_io) {
> +       if (gpio_is_valid(priv->config.reset_n_io)) {
>                 nfc_info(priv->dev, "reset the chip\n");
>                 gpio_set_value(priv->config.reset_n_io, 0);
>                 usleep_range(5000, 10000);
> @@ -255,7 +255,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
>
>  void nfcmrvl_chip_halt(struct nfcmrvl_private *priv)
>  {
> -       if (priv->config.reset_n_io)
> +       if (gpio_is_valid(priv->config.reset_n_io))
>                 gpio_set_value(priv->config.reset_n_io, 0);
>  }
>
> diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
> index 945cc903d8f1..888e298f610b 100644
> --- a/drivers/nfc/nfcmrvl/usb.c
> +++ b/drivers/nfc/nfcmrvl/usb.c
> @@ -305,6 +305,7 @@ static int nfcmrvl_probe(struct usb_interface *intf,
>
>         /* No configuration for USB */
>         memset(&config, 0, sizeof(config));
> +       config.reset_n_io = -EINVAL;
>
>         nfc_info(&udev->dev, "intf %p id %p\n", intf, id);
>
> --
> 2.22.0
>