linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>,
	Robert Walker <robert.walker@arm.com>,
	Mike Leach <mike.leach@linaro.org>,
	Mathieu Poirier <mathieu.poirier@linaro.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.9 19/34] coresight: tpiu: Fix disabling timeouts
Date: Sat, 15 Sep 2018 01:34:37 +0000	[thread overview]
Message-ID: <20180915013422.180023-19-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20180915013422.180023-1-alexander.levin@microsoft.com>

From: Robin Murphy <robin.murphy@arm.com>

[ Upstream commit ccff2dfaceaca4517432f5c149594215fe9098cc ]

Probing the TPIU driver under UBSan triggers an out-of-bounds shift
warning in coresight_timeout():

...
[    5.677530] UBSAN: Undefined behaviour in drivers/hwtracing/coresight/coresight.c:929:16
[    5.685542] shift exponent 64 is too large for 64-bit type 'long unsigned int'
...

On closer inspection things are exponentially out of whack because we're
passing a bitmask where a bit number should be. Amusingly, it seems that
both calls will find their expected values by sheer luck and appear to
succeed: 1 << FFCR_FON_MAN ends up at bit 64 which whilst undefined
evaluates as zero in practice, while 1 << FFSR_FT_STOPPED finds bit 2
(TCPresent) which apparently is usually tied high.

Following the examples of other drivers, define separate FOO and FOO_BIT
macros for masks vs. indices, and put things right.

CC: Robert Walker <robert.walker@arm.com>
CC: Mike Leach <mike.leach@linaro.org>
CC: Mathieu Poirier <mathieu.poirier@linaro.org>
Fixes: 11595db8e17f ("coresight: Fix disabling of CoreSight TPIU")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 drivers/hwtracing/coresight/coresight-tpiu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
index ff579a7c6d00..7473c6ea99e9 100644
--- a/drivers/hwtracing/coresight/coresight-tpiu.c
+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
@@ -47,8 +47,9 @@
 
 /** register definition **/
 /* FFSR - 0x300 */
-#define FFSR_FT_STOPPED		BIT(1)
+#define FFSR_FT_STOPPED_BIT	1
 /* FFCR - 0x304 */
+#define FFCR_FON_MAN_BIT	6
 #define FFCR_FON_MAN		BIT(6)
 #define FFCR_STOP_FI		BIT(12)
 
@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata)
 	/* Generate manual flush */
 	writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR);
 	/* Wait for flush to complete */
-	coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0);
+	coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0);
 	/* Wait for formatter to stop */
-	coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1);
+	coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1);
 
 	CS_LOCK(drvdata->base);
 }
-- 
2.17.1

  parent reply	other threads:[~2018-09-15  1:39 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-15  1:34 [PATCH AUTOSEL 4.9 01/34] binfmt_elf: Respect error return from `regset->active' Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 02/34] audit: fix use-after-free in audit_add_watch Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 03/34] mtdchar: fix overflows in adjustment of `count` Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 04/34] mtd: rawnand: sunxi: Add an U suffix to NFC_PAGE_OP definition Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 05/34] evm: Don't deadlock if a crypto algorithm is unavailable Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 06/34] PM / devfreq: use put_device() instead of kfree() Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 07/34] MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 08/34] configfs: fix registered group removal Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 10/34] ARM: hisi: handle of_iomap and fix missing of_node_put Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 09/34] efi/esrt: Only call efi_mem_reserve() for boot services memory Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 11/34] ARM: hisi: fix error handling and missing of_node_put Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 13/34] gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 12/34] ARM: hisi: check of_iomap and fix missing of_node_put Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 14/34] mmc: tegra: prevent HS200 on Tegra 3 Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 15/34] mmc: sdhci: do not try to use 3.3V signaling if not supported Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 16/34] drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 18/34] coresight: Handle errors in finding input/output ports Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 17/34] parport: sunbpp: fix error return code Sasha Levin
2018-09-15  1:34 ` Sasha Levin [this message]
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 21/34] gpiolib: Mark gpio_suffixes array with __maybe_unused Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 20/34] gpio: pxa: Fix potential NULL dereference Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 22/34] mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 24/34] rcu: Fix grace-period hangs due to race with CPU offline Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 23/34] input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 25/34] drm/amdkfd: Fix error codes in kfd_get_process Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 27/34] ALSA: pcm: Fix snd_interval_refine first/last with open min/max Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 26/34] rtc: bq4802: add error handling for devm_ioremap Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 28/34] selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 29/34] drm/panel: type promotion bug in s6e8aa0_read_mtp_id() Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 30/34] dmaengine: hsu: Support dmaengine_terminate_sync() Sasha Levin
2018-09-20  0:38   ` Vinod
2018-09-24  0:55     ` Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 31/34] dmaengine: idma64: " Sasha Levin
2018-09-20  0:40   ` Vinod
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 32/34] IB/nes: Fix a compiler warning Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 34/34] pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant Sasha Levin
2018-09-15  1:34 ` [PATCH AUTOSEL 4.9 33/34] gpiolib: Respect error code of ->get_direction() Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180915013422.180023-19-alexander.levin@microsoft.com \
    --to=alexander.levin@microsoft.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mathieu.poirier@linaro.org \
    --cc=mike.leach@linaro.org \
    --cc=robert.walker@arm.com \
    --cc=robin.murphy@arm.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).