[PATCH] usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()

[PATCH] usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()

[Dan Carpenter]

This is writing to the first 1 - 3 bytes of "len" and then writing all
four bytes to musb_writel().  The last byte is always going to be
garbage.  Zero out the last bytes instead.

Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/usb/musb/tusb6010.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index c42937692207..c510fb84faa6 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len)
 	}
 	if (len > 0) {
 		/* Write the rest 1 - 3 bytes to FIFO */
+		len = 0;
 		memcpy(&val, buf, len);
 		musb_writel(fifo, 0, val);
 	}
-- 
2.20.1

Re: [PATCH] usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()

[Christophe JAILLET]

Le 15/09/2021 à 12:36, Dan Carpenter a écrit :
> This is writing to the first 1 - 3 bytes of "len" and then writing all
> four bytes to musb_writel().  The last byte is always going to be
> garbage.  Zero out the last bytes instead.
> 
> Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>   drivers/usb/musb/tusb6010.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
> index c42937692207..c510fb84faa6 100644
> --- a/drivers/usb/musb/tusb6010.c
> +++ b/drivers/usb/musb/tusb6010.c
> @@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len)
>   	}
>   	if (len > 0) {
>   		/* Write the rest 1 - 3 bytes to FIFO */
> +		len = 0;

+		val = 0;
?

>   		memcpy(&val, buf, len);
>   		musb_writel(fifo, 0, val);
>   	}
> 


CJ

Re: [PATCH] usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()

[Dan Carpenter]

On Wed, Sep 15, 2021 at 07:49:40PM +0200, Christophe JAILLET wrote:
> Le 15/09/2021 à 12:36, Dan Carpenter a écrit :
> > This is writing to the first 1 - 3 bytes of "len" and then writing all
> > four bytes to musb_writel().  The last byte is always going to be
> > garbage.  Zero out the last bytes instead.
> > 
> > Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> >   drivers/usb/musb/tusb6010.c | 1 +
> >   1 file changed, 1 insertion(+)
> > 
> > diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
> > index c42937692207..c510fb84faa6 100644
> > --- a/drivers/usb/musb/tusb6010.c
> > +++ b/drivers/usb/musb/tusb6010.c
> > @@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len)
> >   	}
> >   	if (len > 0) {
> >   		/* Write the rest 1 - 3 bytes to FIFO */
> > +		len = 0;
> 
> +		val = 0;
> ?

Wow.  Duh!  My goodness...

Thanks for catching that.

regards,
dan carpenter