crypto:hisilicon/qm - some misc-fixes by fuzz test
Subsystems (2)
v2 cover crypto:hisilicon/qm - some misc-fixes by fuzz test
Resolve stack overflow risks for algqos api. Invalid parameter checking is added. And simplify some code.
changes v1->v2:
- modify a comment.
Kai Ye (3):
crypto: hisilicon/qm - increase the memory of local variables
crypto: hisilicon/qm - add pci bdf number check
crypto: hisilicon/qm - delete redundancy check
drivers/crypto/hisilicon/qm.c | 43 +++++++++++------------------------ 1 file changed, 13 insertions(+), 30 deletions(-)
Signature · 1 line
2.17.1
PATCH v2 1/3 crypto: hisilicon/qm - increase the memory of local variables
Increase the buffer to prevent stack overflow by fuzz test.
--- drivers/crypto/hisilicon/qm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/crypto/hisilicon/qm.c +1 -2
@@ -250,7 +250,6 @@#define QM_QOS_MIN_CIR_B 100#define QM_QOS_MAX_CIR_U 6#define QM_QOS_MAX_CIR_S 11 -#define QM_QOS_VAL_MAX_LEN 32#define QM_DFX_BASE 0x0100000#define QM_DFX_STATE1 0x0104000#define QM_DFX_STATE2 0x01040C8
@@ -4612,7 +4611,7 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, unsigned int *fun_index) {char tbuf_bdf[QM_DBG_READ_LEN ] = {0 }; -char val_buf[QM_QOS_VAL_MAX_LEN ] = {0 }; +char val_buf[QM_DBG_READ_LEN ] = {0 };u32 tmp1, device, function;int ret, bus;
Signature · 1 line
2.17.1
Herbert Xu
maintainerRe: [PATCH v2 1/3] crypto: hisilicon/qm - increase the memory of local variables
Quoted 20 lines · Kai Ye
Increase the buffer to prevent stack overflow by fuzz test.
Signed-off-by Kai Ye <[email protected]>--- drivers/crypto/hisilicon/qm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)drivers/crypto/hisilicon/qm.c +0
-1@@ -250,7 +250,6 @@#define QM_QOS_MIN_CIR_B 100#define QM_QOS_MAX_CIR_U 6#define QM_QOS_MAX_CIR_S 11 -#define QM_QOS_VAL_MAX_LEN 32#define QM_DFX_BASE 0x0100000#define QM_DFX_STATE1 0x0104000#define QM_DFX_STATE2 0x01040C8
drivers/crypto/hisilicon/qm.c static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, · line 4614
Quoted 5 lines
drivers/crypto/hisilicon/qm.c +1
-1@@ -4612,7 +4611,7 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, unsigned int *fun_index) {char tbuf_bdf[QM_DBG_READ_LEN ] = {0 }; -char val_buf[QM_QOS_VAL_MAX_LEN ] = {0 }; +char val_buf[QM_DBG_READ_LEN ] = {0 };
Please document how this value was derived in the patch log.
Thanks,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
PATCH v2 2/3 crypto: hisilicon/qm - add pci bdf number check
In reply to Kai YeThe pci bdf number check is added for qos written by using the pci api. Directly get the devfn by pci_dev, so delete some redundant code. And use the kstrtoul instead of sscanf to simplify code.
--- drivers/crypto/hisilicon/qm.c | 37 ++++++++++++----------------------- 1 file changed, 12 insertions(+), 25 deletions(-)
drivers/crypto/hisilicon/qm.c +12 -25
@@ -4589,49 +4589,36 @@ static ssize_t qm_algqos_read(struct file *filp, char __user *buf,return ret; } -static ssize_t qm_qos_value_init (const char *buf,unsigned long *val) -{ -int buflen =strlen (buf); -int ret, i; - -for (i =0 ; i < buflen; i++) { -if (!isdigit (buf[i])) -return -EINVAL ; - } - - ret =sscanf (buf,"%lu" , val); -if (ret !=QM_QOS_VAL_NUM ) -return -EINVAL ; - -return 0 ; -} -static ssize_t qm_get_qos_value (struct hisi_qm *qm,const char *buf,unsigned long *val,unsigned int *fun_index) { +struct bus_type *bus_type = qm->pdev->dev.bus;char tbuf_bdf[QM_DBG_READ_LEN ] = {0 };char val_buf[QM_DBG_READ_LEN ] = {0 }; -u32 tmp1, device, function; -int ret, bus; +struct pci_dev *pdev; +struct device *dev; +int ret; ret =sscanf (buf,"%s %s" , tbuf_bdf, val_buf);if (ret !=QM_QOS_PARAM_NUM )return -EINVAL ; - ret =qm_qos_value_init (val_buf, val); + ret =kstrtoul (val_buf,10 , val);if (ret || *val ==0 || *val >QM_QOS_MAX_VAL ) {pci_err (qm->pdev,"input qos value is error, please set 1~1000!\n" );return -EINVAL ; } - ret =sscanf (tbuf_bdf,"%u:%x:%u.%u" , &tmp1, &bus, &device, &function); -if (ret !=QM_QOS_BDF_PARAM_NUM ) { -pci_err (qm->pdev,"input pci bdf value is error!\n" ); -return -EINVAL ; + dev =bus_find_device_by_name (bus_type,NULL , tbuf_bdf); +if (!dev) { +pci_err (qm->pdev,"input pci bdf number is error!\n" ); +return -ENODEV ; } - *fun_index =PCI_DEVFN (device, function); + pdev = container_of(dev, struct pci_dev, dev); + + *fun_index = pdev->devfn;return 0 ; }
Signature · 1 line
2.17.1
PATCH v2 3/3 crypto: hisilicon/qm - delete redundancy check
In reply to Kai YeBecause the permission on the VF debugfs file is "0444". So the VF function checking is redundant in qos writing api.
--- drivers/crypto/hisilicon/qm.c | 3 --- 1 file changed, 3 deletions(-)
drivers/crypto/hisilicon/qm.c +0 -3
@@ -4632,9 +4632,6 @@ static ssize_t qm_algqos_write(struct file *filp, const char __user *buf,unsigned long val;int len, ret; -if (qm->fun_type ==QM_HW_VF ) -return -EINVAL ; -if (*pos !=0 )return 0 ;
Signature · 1 line
2.17.1