* [PATCH v2 1/2] firmware: socfpga: Fix a bug in fpgamgr_program_write_buf()
@ 2015-04-20 12:37 Andrey Smirnov
2015-04-21 12:28 ` Sascha Hauer
0 siblings, 1 reply; 3+ messages in thread
From: Andrey Smirnov @ 2015-04-20 12:37 UTC (permalink / raw)
To: barebox; +Cc: Andrey Smirnov
Fix a bug in fpgamgr_program_write_buf() where .rbf file whose length
is not a multiple of 4 would cause an integer overflow which would
result in infinite loop.
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
drivers/firmware/socfpga.c | 24 +++++++++++++++++++-----
1 file changed, 19 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/socfpga.c b/drivers/firmware/socfpga.c
index a5dc607..71f260f 100644
--- a/drivers/firmware/socfpga.c
+++ b/drivers/firmware/socfpga.c
@@ -321,14 +321,28 @@ static int fpgamgr_program_write_buf(struct firmware_handler *fh, const void *bu
size_t size)
{
struct fpgamgr *mgr = container_of(fh, struct fpgamgr, fh);
- const uint32_t *buf32 = buf;
+ const uint8_t *buffer = buf;
+ uint32_t word;
+ size_t chunk_size;
+ size_t offset = 0;
/* write to FPGA Manager AXI data */
- while (size) {
- writel(*buf32, mgr->regs_data);
- readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS);
- buf32++;
+ while (size >= sizeof(uint32_t)) {
size -= sizeof(uint32_t);
+
+ word = *(uint32_t *)(buffer + offset);
+ offset += sizeof(uint32_t);
+
+ writel(word, mgr->regs_data);
+ readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS);
+ }
+
+ if (size) {
+ word = 0;
+ while (chunk_size--) {
+ word |= buffer[offset++];
+ word <<= 8;
+ }
}
return 0;
--
2.1.4
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v2 1/2] firmware: socfpga: Fix a bug in fpgamgr_program_write_buf()
2015-04-20 12:37 [PATCH v2 1/2] firmware: socfpga: Fix a bug in fpgamgr_program_write_buf() Andrey Smirnov
@ 2015-04-21 12:28 ` Sascha Hauer
2015-04-21 21:59 ` Andrey Smirnov
0 siblings, 1 reply; 3+ messages in thread
From: Sascha Hauer @ 2015-04-21 12:28 UTC (permalink / raw)
To: Andrey Smirnov; +Cc: barebox
Hi Andrey,
On Mon, Apr 20, 2015 at 05:37:43AM -0700, Andrey Smirnov wrote:
> Fix a bug in fpgamgr_program_write_buf() where .rbf file whose length
> is not a multiple of 4 would cause an integer overflow which would
> result in infinite loop.
>
> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
> ---
> drivers/firmware/socfpga.c | 24 +++++++++++++++++++-----
> 1 file changed, 19 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/firmware/socfpga.c b/drivers/firmware/socfpga.c
> index a5dc607..71f260f 100644
> --- a/drivers/firmware/socfpga.c
> +++ b/drivers/firmware/socfpga.c
> @@ -321,14 +321,28 @@ static int fpgamgr_program_write_buf(struct firmware_handler *fh, const void *bu
> size_t size)
> {
> struct fpgamgr *mgr = container_of(fh, struct fpgamgr, fh);
> - const uint32_t *buf32 = buf;
> + const uint8_t *buffer = buf;
> + uint32_t word;
> + size_t chunk_size;
> + size_t offset = 0;
>
> /* write to FPGA Manager AXI data */
> - while (size) {
> - writel(*buf32, mgr->regs_data);
> - readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS);
> - buf32++;
> + while (size >= sizeof(uint32_t)) {
> size -= sizeof(uint32_t);
> +
> + word = *(uint32_t *)(buffer + offset);
> + offset += sizeof(uint32_t);
> +
> + writel(word, mgr->regs_data);
> + readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS);
> + }
Can't the original loop body stay like it was before?
> +
> + if (size) {
> + word = 0;
> + while (chunk_size--) {
chunk_size is never initialized.
> + word |= buffer[offset++];
> + word <<= 8;
The remaining data is never written.
Sascha
--
Pengutronix e.K. | |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v2 1/2] firmware: socfpga: Fix a bug in fpgamgr_program_write_buf()
2015-04-21 12:28 ` Sascha Hauer
@ 2015-04-21 21:59 ` Andrey Smirnov
0 siblings, 0 replies; 3+ messages in thread
From: Andrey Smirnov @ 2015-04-21 21:59 UTC (permalink / raw)
To: Sascha Hauer; +Cc: barebox
On Tue, Apr 21, 2015 at 5:28 AM, Sascha Hauer <s.hauer@pengutronix.de> wrote:
> Hi Andrey,
>
> On Mon, Apr 20, 2015 at 05:37:43AM -0700, Andrey Smirnov wrote:
>> Fix a bug in fpgamgr_program_write_buf() where .rbf file whose length
>> is not a multiple of 4 would cause an integer overflow which would
>> result in infinite loop.
>>
>> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
>> ---
>> drivers/firmware/socfpga.c | 24 +++++++++++++++++++-----
>> 1 file changed, 19 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/firmware/socfpga.c b/drivers/firmware/socfpga.c
>> index a5dc607..71f260f 100644
>> --- a/drivers/firmware/socfpga.c
>> +++ b/drivers/firmware/socfpga.c
>> @@ -321,14 +321,28 @@ static int fpgamgr_program_write_buf(struct firmware_handler *fh, const void *bu
>> size_t size)
>> {
>> struct fpgamgr *mgr = container_of(fh, struct fpgamgr, fh);
>> - const uint32_t *buf32 = buf;
>> + const uint8_t *buffer = buf;
>> + uint32_t word;
>> + size_t chunk_size;
>> + size_t offset = 0;
>>
>> /* write to FPGA Manager AXI data */
>> - while (size) {
>> - writel(*buf32, mgr->regs_data);
>> - readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS);
>> - buf32++;
>> + while (size >= sizeof(uint32_t)) {
>> size -= sizeof(uint32_t);
>> +
>> + word = *(uint32_t *)(buffer + offset);
>> + offset += sizeof(uint32_t);
>> +
>> + writel(word, mgr->regs_data);
>> + readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS);
>> + }
>
> Can't the original loop body stay like it was before?
I haven't thought of that, but yeah it is a good idea. I will do that.
>
>> +
>> + if (size) {
>> + word = 0;
>> + while (chunk_size--) {
>
> chunk_size is never initialized.
>
>> + word |= buffer[offset++];
>> + word <<= 8;
>
> The remaining data is never written.
Hmm, I could have sworn I tested this patch, but you are right this
code cannot be correct. I'll update it and test the code more
thoroughly this time.
>
> Sascha
>
> --
> Pengutronix e.K. | |
> Industrial Linux Solutions | http://www.pengutronix.de/ |
> Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
> Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-04-21 22:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-04-20 12:37 [PATCH v2 1/2] firmware: socfpga: Fix a bug in fpgamgr_program_write_buf() Andrey Smirnov
2015-04-21 12:28 ` Sascha Hauer
2015-04-21 21:59 ` Andrey Smirnov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox