[GIT PULL] MFD fixes for v5.2

[GIT PULL] MFD fixes for v5.2

[Lee Jones]

Linus,

Enjoy!

The following changes since commit a188339ca5a396acc588e5851ed7e19f66b0ebd9:

  Linux 5.2-rc1 (2019-05-19 15:47:09 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd.git tags/mfd-fixes-5.2

for you to fetch changes up to cd49b84d61b2dfc0360c76d9e6be49f5116ba1a5:

  mfd: stmfx: Uninitialized variable in stmfx_irq_handler() (2019-06-17 10:51:15 +0100)

----------------------------------------------------------------
 - Bug Fixes
   - Resize variable to avoid uninitialised (MSB) data

----------------------------------------------------------------
Dan Carpenter (1):
      mfd: stmfx: Uninitialized variable in stmfx_irq_handler()

 drivers/mfd/stmfx.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [GIT PULL] MFD fixes for v5.2

[Linus Torvalds]

On Mon, Jun 17, 2019 at 3:01 AM Lee Jones <lee.jones@linaro.org> wrote:
>
> Enjoy!

No.

This is still entirely wrong.

You can't just randomly cast an "u32 *" to "unsigned long *".

It wasn't correct when you did it the other way in regmap_read(), but
it's also not correct when you now for it this way for
for_each_set_bit().

You can do

    u32 regmap_bits;
    unsigned long bits;

and then

    ret = regmap_read(stmfx->map, STMFX_REG_IRQ_PENDING, &regmap_bits);
    ...
    bits = regmap_bits;
    for_each_set_bit(n, &bits, STMFX_REG_IRQ_SRC_MAX) ..

but casting pointers at either point is *completely* wrong.

Yes, yes, it happens to work on little-endian, but on a 64-bit
big-endian machine, the low 32 bits of the "unsigned int" will have
absolutely _zero_ overlap with the low 32 bits of the "unsigned long"
in memory.

When you moved the cast to for_each_set_bit(), it only moves the
access of the bogus bits to another place instead.

So that patch doesn't fix anything at all, it only moves the same error around.

                      Linus

Re: [GIT PULL] MFD fixes for v5.2

[Dan Carpenter]

Ah...  Sorry.  There are a couple similar bugs in other places and I'll
take a look at those tomorrow as well.

regards,
dan carpenter

[PATCH] mfd: stmfx: Fix an endian bug in stmfx_irq_handler()

[Dan Carpenter]

It's not okay to cast a "u32 *" to "unsigned long *" when you are
doing a for_each_set_bit() loop because that will break on big
endian systems.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: 386145601b82 ("mfd: stmfx: Uninitialized variable in stmfx_irq_handler()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/mfd/stmfx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
index 7c419c078688..857991cb3cbb 100644
--- a/drivers/mfd/stmfx.c
+++ b/drivers/mfd/stmfx.c
@@ -204,6 +204,7 @@ static struct irq_chip stmfx_irq_chip = {
 static irqreturn_t stmfx_irq_handler(int irq, void *data)
 {
 	struct stmfx *stmfx = data;
+	unsigned long bits;
 	u32 pending, ack;
 	int n, ret;
 
@@ -222,7 +223,8 @@ static irqreturn_t stmfx_irq_handler(int irq, void *data)
 			return IRQ_NONE;
 	}
 
-	for_each_set_bit(n, (unsigned long *)&pending, STMFX_REG_IRQ_SRC_MAX)
+	bits = pending;
+	for_each_set_bit(n, &bits, STMFX_REG_IRQ_SRC_MAX)
 		handle_nested_irq(irq_find_mapping(stmfx->irq_domain, n));
 
 	return IRQ_HANDLED;
-- 
2.20.1

Re: [GIT PULL] MFD fixes for v5.2

[Lee Jones]

On Mon, 17 Jun 2019, Linus Torvalds wrote:

> On Mon, Jun 17, 2019 at 3:01 AM Lee Jones <lee.jones@linaro.org> wrote:
> >
> > Enjoy!
> 
> No.
> 
> This is still entirely wrong.
> 
> You can't just randomly cast an "u32 *" to "unsigned long *".
> 
> It wasn't correct when you did it the other way in regmap_read(), but
> it's also not correct when you now for it this way for
> for_each_set_bit().
> 
> You can do
> 
>     u32 regmap_bits;
>     unsigned long bits;
> 
> and then
> 
>     ret = regmap_read(stmfx->map, STMFX_REG_IRQ_PENDING, &regmap_bits);
>     ...
>     bits = regmap_bits;
>     for_each_set_bit(n, &bits, STMFX_REG_IRQ_SRC_MAX) ..
> 
> but casting pointers at either point is *completely* wrong.
> 
> Yes, yes, it happens to work on little-endian, but on a 64-bit
> big-endian machine, the low 32 bits of the "unsigned int" will have
> absolutely _zero_ overlap with the low 32 bits of the "unsigned long"
> in memory.
> 
> When you moved the cast to for_each_set_bit(), it only moves the
> access of the bogus bits to another place instead.
> 
> So that patch doesn't fix anything at all, it only moves the same error around.

Good catch.  Thank you for taking the time to review Linus.

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH] mfd: stmfx: Fix an endian bug in stmfx_irq_handler()

[Lee Jones]

On Mon, 17 Jun 2019, Dan Carpenter wrote:

> It's not okay to cast a "u32 *" to "unsigned long *" when you are
> doing a for_each_set_bit() loop because that will break on big
> endian systems.
> 
> Reported-by: Linus Torvalds <torvalds@linux-foundation.org>

Ideally we can get a review too.

> Fixes: 386145601b82 ("mfd: stmfx: Uninitialized variable in stmfx_irq_handler()")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/mfd/stmfx.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
> index 7c419c078688..857991cb3cbb 100644
> --- a/drivers/mfd/stmfx.c
> +++ b/drivers/mfd/stmfx.c
> @@ -204,6 +204,7 @@ static struct irq_chip stmfx_irq_chip = {
>  static irqreturn_t stmfx_irq_handler(int irq, void *data)
>  {
>  	struct stmfx *stmfx = data;
> +	unsigned long bits;
>  	u32 pending, ack;
>  	int n, ret;
>  
> @@ -222,7 +223,8 @@ static irqreturn_t stmfx_irq_handler(int irq, void *data)
>  			return IRQ_NONE;
>  	}
>  
> -	for_each_set_bit(n, (unsigned long *)&pending, STMFX_REG_IRQ_SRC_MAX)
> +	bits = pending;
> +	for_each_set_bit(n, &bits, STMFX_REG_IRQ_SRC_MAX)
>  		handle_nested_irq(irq_find_mapping(stmfx->irq_domain, n));
>  
>  	return IRQ_HANDLED;

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH] mfd: stmfx: Fix an endian bug in stmfx_irq_handler()

[Linus Torvalds]

On Tue, Jun 18, 2019 at 1:16 AM Lee Jones <lee.jones@linaro.org> wrote:
>
> > Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
>
> Ideally we can get a review too.

Looks fine to me, but obviously somebody should actually _test_ it too.

              Linus

Re: [PATCH] mfd: stmfx: Fix an endian bug in stmfx_irq_handler()

[Lee Jones]

On Tue, 18 Jun 2019, Linus Torvalds wrote:

> On Tue, Jun 18, 2019 at 1:16 AM Lee Jones <lee.jones@linaro.org> wrote:
> >
> > > Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
> >
> > Ideally we can get a review too.
> 
> Looks fine to me, but obviously somebody should actually _test_ it too.

Amelie, would you be so kind?

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH] mfd: stmfx: Fix an endian bug in stmfx_irq_handler()

[Amelie DELAUNAY]

On 6/19/19 7:58 AM, Lee Jones wrote:
> On Tue, 18 Jun 2019, Linus Torvalds wrote:
> 
>> On Tue, Jun 18, 2019 at 1:16 AM Lee Jones <lee.jones@linaro.org> wrote:
>>>
>>>> Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
>>>
>>> Ideally we can get a review too.
>>
>> Looks fine to me, but obviously somebody should actually _test_ it too.
> 
> Amelie, would you be so kind?
> 

Tested on stm32mp157c-ev1.

Tested-by: Amelie Delaunay <amelie.delaunay@st.com>

[GIT PULL v2] MFD fixes for v5.2

[Lee Jones]

Linus,

Hopefully this is more to your liking.

The following changes since commit a188339ca5a396acc588e5851ed7e19f66b0ebd9:

  Linux 5.2-rc1 (2019-05-19 15:47:09 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd.git mfd-fixes-5.2-1

for you to fetch changes up to 63b2de12b7eeacfb2edbe005f5c3cff17a2a02e2:

  mfd: stmfx: Fix an endian bug in stmfx_irq_handler() (2019-06-24 15:19:31 +0100)

----------------------------------------------------------------
 - Bug Fixes
   - Resize variable to avoid uninitialised (MSB) data; stmfx
   - Fixe endian bug; stmfx

----------------------------------------------------------------
Dan Carpenter (2):
      mfd: stmfx: Uninitialized variable in stmfx_irq_handler()
      mfd: stmfx: Fix an endian bug in stmfx_irq_handler()

 drivers/mfd/stmfx.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [GIT PULL v2] MFD fixes for v5.2

[Linus Torvalds]

On Mon, Jun 24, 2019 at 10:34 PM Lee Jones <lee.jones@linaro.org> wrote:
>
> Hopefully this is more to your liking.

I would actually have preferred you to throw the old buggy "fix" away,
and just do the final state.

But the end result looks sane, so I pulled it.

           Linus

Re: [GIT PULL] MFD fixes for v5.2

[pr-tracker-bot]

The pull request you sent on Mon, 17 Jun 2019 11:00:54 +0100:

> git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd.git tags/mfd-fixes-5.2

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/63b2de12b7eeacfb2edbe005f5c3cff17a2a02e2

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

Re: [GIT PULL v2] MFD fixes for v5.2

[pr-tracker-bot]

The pull request you sent on Mon, 24 Jun 2019 15:34:11 +0100:

> git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd.git mfd-fixes-5.2-1

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/c88e40e07cd967dcdf37321a63ab6e8b0d881100

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

Re: [GIT PULL v2] MFD fixes for v5.2

[Lee Jones]

On Tue, 25 Jun 2019, Linus Torvalds wrote:

> On Mon, Jun 24, 2019 at 10:34 PM Lee Jones <lee.jones@linaro.org> wrote:
> >
> > Hopefully this is more to your liking.
> 
> I would actually have preferred you to throw the old buggy "fix" away,
> and just do the final state.

You okayed the follow-up patch, so I took it as-is.

> But the end result looks sane, so I pulled it.

Sounds good, thanks.

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog