From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>,
Robert Walker <robert.walker@arm.com>,
Mike Leach <mike.leach@linaro.org>,
Mathieu Poirier <mathieu.poirier@linaro.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.4 12/20] coresight: tpiu: Fix disabling timeouts
Date: Sat, 15 Sep 2018 01:35:12 +0000 [thread overview]
Message-ID: <20180915013502.180110-12-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20180915013502.180110-1-alexander.levin@microsoft.com>
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit ccff2dfaceaca4517432f5c149594215fe9098cc ]
Probing the TPIU driver under UBSan triggers an out-of-bounds shift
warning in coresight_timeout():
...
[ 5.677530] UBSAN: Undefined behaviour in drivers/hwtracing/coresight/coresight.c:929:16
[ 5.685542] shift exponent 64 is too large for 64-bit type 'long unsigned int'
...
On closer inspection things are exponentially out of whack because we're
passing a bitmask where a bit number should be. Amusingly, it seems that
both calls will find their expected values by sheer luck and appear to
succeed: 1 << FFCR_FON_MAN ends up at bit 64 which whilst undefined
evaluates as zero in practice, while 1 << FFSR_FT_STOPPED finds bit 2
(TCPresent) which apparently is usually tied high.
Following the examples of other drivers, define separate FOO and FOO_BIT
macros for masks vs. indices, and put things right.
CC: Robert Walker <robert.walker@arm.com>
CC: Mike Leach <mike.leach@linaro.org>
CC: Mathieu Poirier <mathieu.poirier@linaro.org>
Fixes: 11595db8e17f ("coresight: Fix disabling of CoreSight TPIU")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
drivers/hwtracing/coresight/coresight-tpiu.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
index 22e10b7d505d..fe3a2b19a5db 100644
--- a/drivers/hwtracing/coresight/coresight-tpiu.c
+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
@@ -46,8 +46,9 @@
/** register definition **/
/* FFSR - 0x300 */
-#define FFSR_FT_STOPPED BIT(1)
+#define FFSR_FT_STOPPED_BIT 1
/* FFCR - 0x304 */
+#define FFCR_FON_MAN_BIT 6
#define FFCR_FON_MAN BIT(6)
#define FFCR_STOP_FI BIT(12)
@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata)
/* Generate manual flush */
writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR);
/* Wait for flush to complete */
- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0);
+ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0);
/* Wait for formatter to stop */
- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1);
+ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1);
CS_LOCK(drvdata->base);
}
--
2.17.1
next prev parent reply other threads:[~2018-09-15 1:37 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-15 1:35 [PATCH AUTOSEL 4.4 01/20] binfmt_elf: Respect error return from `regset->active' Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 02/20] audit: fix use-after-free in audit_add_watch Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 03/20] mtdchar: fix overflows in adjustment of `count` Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 04/20] mtd: rawnand: sunxi: Add an U suffix to NFC_PAGE_OP definition Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 05/20] MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 07/20] ARM: hisi: fix error handling and missing of_node_put Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 06/20] ARM: hisi: handle of_iomap and fix " Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 09/20] drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 08/20] ARM: hisi: check of_iomap and fix missing of_node_put Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 10/20] parport: sunbpp: fix error return code Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 11/20] coresight: Handle errors in finding input/output ports Sasha Levin
2018-09-15 1:35 ` Sasha Levin [this message]
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 13/20] gpiolib: Mark gpio_suffixes array with __maybe_unused Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 14/20] drm/amdkfd: Fix error codes in kfd_get_process Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 15/20] rtc: bq4802: add error handling for devm_ioremap Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 16/20] ALSA: pcm: Fix snd_interval_refine first/last with open min/max Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 17/20] selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 18/20] drm/panel: type promotion bug in s6e8aa0_read_mtp_id() Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 19/20] IB/nes: Fix a compiler warning Sasha Levin
2018-09-15 1:35 ` [PATCH AUTOSEL 4.4 20/20] pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180915013502.180110-12-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mathieu.poirier@linaro.org \
--cc=mike.leach@linaro.org \
--cc=robert.walker@arm.com \
--cc=robin.murphy@arm.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).