From: Mike Leach <mike.leach@linaro.org> To: mike.leach@linaro.org, coresight@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org Cc: mathieu.poirier@linaro.org, corbet@lwn.net, gregkh@linuxfoundation.org, suzuki.poulose@arm.com, stable <stable@vger.kernel.org> Subject: [PATCH v3 02/11] coresight: etm4x: Fix input validation for sysfs. Date: Tue, 15 Oct 2019 22:19:55 +0100 [thread overview] Message-ID: <20191015212004.24748-3-mike.leach@linaro.org> (raw) In-Reply-To: <20191015212004.24748-1-mike.leach@linaro.org> A number of issues are fixed relating to sysfs input validation:- 1) bb_ctrl_store() - incorrect compare of bit select field to absolute value. Reworked per ETMv4 specification. 2) seq_event_store() - incorrect mask value - register has two event values. 3) cyc_threshold_store() - must mask with max before checking min otherwise wrapped values can set illegal value below min. 4) res_ctrl_store() - update to mask off all res0 bits. Reviewed-by: Leo Yan <leo.yan@linaro.org> Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Mike Leach <mike.leach@linaro.org> Fixes: a77de2637c9eb ("coresight: etm4x: moving sysFS entries to a dedicated file") Cc: stable <stable@vger.kernel.org> # 4.9+ --- .../coresight/coresight-etm4x-sysfs.c | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c index b6984be0c515..cc8156318018 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c @@ -652,10 +652,13 @@ static ssize_t cyc_threshold_store(struct device *dev, if (kstrtoul(buf, 16, &val)) return -EINVAL; + + /* mask off max threshold before checking min value */ + val &= ETM_CYC_THRESHOLD_MASK; if (val < drvdata->ccitmin) return -EINVAL; - config->ccctlr = val & ETM_CYC_THRESHOLD_MASK; + config->ccctlr = val; return size; } static DEVICE_ATTR_RW(cyc_threshold); @@ -686,14 +689,16 @@ static ssize_t bb_ctrl_store(struct device *dev, return -EINVAL; if (!drvdata->nr_addr_cmp) return -EINVAL; + /* - * Bit[7:0] selects which address range comparator is used for - * branch broadcast control. + * Bit[8] controls include(1) / exclude(0), bits[0-7] select + * individual range comparators. If include then at least 1 + * range must be selected. */ - if (BMVAL(val, 0, 7) > drvdata->nr_addr_cmp) + if ((val & BIT(8)) && (BMVAL(val, 0, 7) == 0)) return -EINVAL; - config->bb_ctrl = val; + config->bb_ctrl = val & GENMASK(8, 0); return size; } static DEVICE_ATTR_RW(bb_ctrl); @@ -1324,8 +1329,8 @@ static ssize_t seq_event_store(struct device *dev, spin_lock(&drvdata->spinlock); idx = config->seq_idx; - /* RST, bits[7:0] */ - config->seq_ctrl[idx] = val & 0xFF; + /* Seq control has two masks B[15:8] F[7:0] */ + config->seq_ctrl[idx] = val & 0xFFFF; spin_unlock(&drvdata->spinlock); return size; } @@ -1580,7 +1585,7 @@ static ssize_t res_ctrl_store(struct device *dev, if (idx % 2 != 0) /* PAIRINV, bit[21] */ val &= ~BIT(21); - config->res_ctrl[idx] = val; + config->res_ctrl[idx] = val & GENMASK(21, 0); spin_unlock(&drvdata->spinlock); return size; } -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Mike Leach <mike.leach@linaro.org> To: mike.leach@linaro.org, coresight@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org Cc: gregkh@linuxfoundation.org, suzuki.poulose@arm.com, stable <stable@vger.kernel.org>, mathieu.poirier@linaro.org, corbet@lwn.net Subject: [PATCH v3 02/11] coresight: etm4x: Fix input validation for sysfs. Date: Tue, 15 Oct 2019 22:19:55 +0100 [thread overview] Message-ID: <20191015212004.24748-3-mike.leach@linaro.org> (raw) In-Reply-To: <20191015212004.24748-1-mike.leach@linaro.org> A number of issues are fixed relating to sysfs input validation:- 1) bb_ctrl_store() - incorrect compare of bit select field to absolute value. Reworked per ETMv4 specification. 2) seq_event_store() - incorrect mask value - register has two event values. 3) cyc_threshold_store() - must mask with max before checking min otherwise wrapped values can set illegal value below min. 4) res_ctrl_store() - update to mask off all res0 bits. Reviewed-by: Leo Yan <leo.yan@linaro.org> Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Mike Leach <mike.leach@linaro.org> Fixes: a77de2637c9eb ("coresight: etm4x: moving sysFS entries to a dedicated file") Cc: stable <stable@vger.kernel.org> # 4.9+ --- .../coresight/coresight-etm4x-sysfs.c | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c index b6984be0c515..cc8156318018 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c @@ -652,10 +652,13 @@ static ssize_t cyc_threshold_store(struct device *dev, if (kstrtoul(buf, 16, &val)) return -EINVAL; + + /* mask off max threshold before checking min value */ + val &= ETM_CYC_THRESHOLD_MASK; if (val < drvdata->ccitmin) return -EINVAL; - config->ccctlr = val & ETM_CYC_THRESHOLD_MASK; + config->ccctlr = val; return size; } static DEVICE_ATTR_RW(cyc_threshold); @@ -686,14 +689,16 @@ static ssize_t bb_ctrl_store(struct device *dev, return -EINVAL; if (!drvdata->nr_addr_cmp) return -EINVAL; + /* - * Bit[7:0] selects which address range comparator is used for - * branch broadcast control. + * Bit[8] controls include(1) / exclude(0), bits[0-7] select + * individual range comparators. If include then at least 1 + * range must be selected. */ - if (BMVAL(val, 0, 7) > drvdata->nr_addr_cmp) + if ((val & BIT(8)) && (BMVAL(val, 0, 7) == 0)) return -EINVAL; - config->bb_ctrl = val; + config->bb_ctrl = val & GENMASK(8, 0); return size; } static DEVICE_ATTR_RW(bb_ctrl); @@ -1324,8 +1329,8 @@ static ssize_t seq_event_store(struct device *dev, spin_lock(&drvdata->spinlock); idx = config->seq_idx; - /* RST, bits[7:0] */ - config->seq_ctrl[idx] = val & 0xFF; + /* Seq control has two masks B[15:8] F[7:0] */ + config->seq_ctrl[idx] = val & 0xFFFF; spin_unlock(&drvdata->spinlock); return size; } @@ -1580,7 +1585,7 @@ static ssize_t res_ctrl_store(struct device *dev, if (idx % 2 != 0) /* PAIRINV, bit[21] */ val &= ~BIT(21); - config->res_ctrl[idx] = val; + config->res_ctrl[idx] = val & GENMASK(21, 0); spin_unlock(&drvdata->spinlock); return size; } -- 2.17.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2019-10-15 21:21 UTC|newest] Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-10-15 21:19 [PATCH v3 00/11] coresight: etm4x: Fixes and updates for sysfs API Mike Leach 2019-10-15 21:19 ` Mike Leach 2019-10-15 21:19 ` [PATCH v3 01/11] coresight: etm4x: Fixes for ETM v4.4 architecture updates Mike Leach 2019-10-15 21:19 ` Mike Leach 2019-10-17 17:55 ` Mathieu Poirier 2019-10-17 17:55 ` Mathieu Poirier 2019-10-15 21:19 ` Mike Leach [this message] 2019-10-15 21:19 ` [PATCH v3 02/11] coresight: etm4x: Fix input validation for sysfs Mike Leach 2019-10-17 17:56 ` Mathieu Poirier 2019-10-17 17:56 ` Mathieu Poirier 2019-10-15 21:19 ` [PATCH v3 03/11] coresight: etm4x: Add missing API to set EL match on address filters Mike Leach 2019-10-15 21:19 ` Mike Leach 2019-10-17 18:00 ` Mathieu Poirier 2019-10-17 18:00 ` Mathieu Poirier 2019-10-17 19:25 ` Mathieu Poirier 2019-10-17 19:25 ` Mathieu Poirier 2019-10-15 21:19 ` [PATCH v3 04/11] coresight: etm4x: Fix issues with start-stop logic Mike Leach 2019-10-15 21:19 ` Mike Leach 2019-10-15 21:19 ` [PATCH v3 05/11] coresight: etm4x: Improve usability of sysfs - include/exclude addr Mike Leach 2019-10-15 21:19 ` Mike Leach 2019-10-15 21:19 ` [PATCH v3 06/11] coresight: etm4x: Improve usability of sysfs - CID and VMID masks Mike Leach 2019-10-15 21:19 ` Mike Leach 2019-10-15 21:20 ` [PATCH v3 07/11] coresight: etm4x: Add view comparator settings API to sysfs Mike Leach 2019-10-15 21:20 ` Mike Leach 2019-10-15 21:20 ` [PATCH v3 08/11] coresight: etm4x: Add missing single-shot control " Mike Leach 2019-10-15 21:20 ` Mike Leach 2019-10-17 20:17 ` Mathieu Poirier 2019-10-17 20:17 ` Mathieu Poirier 2019-10-15 21:20 ` [PATCH v3 09/11] coresight: etm4x: docs: Update ABI doc for sysfs features added Mike Leach 2019-10-15 21:20 ` Mike Leach 2019-10-18 16:16 ` Mathieu Poirier 2019-10-18 16:16 ` Mathieu Poirier 2019-10-15 21:20 ` [PATCH v3 10/11] coresight: docs: Create common sub-directory for coresight trace Mike Leach 2019-10-15 21:20 ` Mike Leach 2019-10-18 16:20 ` Mathieu Poirier 2019-10-18 16:20 ` Mathieu Poirier 2019-10-18 17:31 ` Mathieu Poirier 2019-10-18 17:31 ` Mathieu Poirier 2019-10-24 10:46 ` Mike Leach 2019-10-24 10:46 ` Mike Leach 2019-10-15 21:20 ` [PATCH v3 11/11] coresight: etm4x: docs: Adds detailed document for programming etm4x Mike Leach 2019-10-15 21:20 ` Mike Leach 2019-10-18 17:27 ` Mathieu Poirier 2019-10-18 17:27 ` Mathieu Poirier
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20191015212004.24748-3-mike.leach@linaro.org \ --to=mike.leach@linaro.org \ --cc=corbet@lwn.net \ --cc=coresight@lists.linaro.org \ --cc=gregkh@linuxfoundation.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-doc@vger.kernel.org \ --cc=mathieu.poirier@linaro.org \ --cc=stable@vger.kernel.org \ --cc=suzuki.poulose@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.