Skip to contentSkip to conversation

arch-sh csum_partial_copy_generic() bugfix

PATCH In review Ollie Wild 2 participants 4 messages Aug 25, 2005 – Sep 2, 2005 SuperH

lore
Share & tools
lore

Ollie Wild

author
#0 lore raw

PATCH 1/1 arch-sh csum_partial_copy_generic() bugfix

There's a bug in Hitachi SuperH csum_partial_copy_generic() implementation. If the supplied length is 1 (and several alignment conditions are met), the function immediately branches to label 4. However, the assembly at label 4 expects the length to be stored in register r2. Since this has not occurred, subsequent behavior is undefined.

This can cause bad payload checksums in TCP connections.

I've fixed the problem by initializing register r2 prior to the branch instruction.

Ollie

arch/sh/lib/checksum.S +2 -1
@@ -202,8 +202,9 @@ ENTRY(csum_partial_copy_generic)
 	cmp/pz	r6		! Jump if we had at least two bytes.
 	bt/s	1f
 	 clrt
+	add	#2,r6		! r6 was < 2.	Deal with it.
 	bra	4f
-	 add	#2,r6		! r6 was < 2.	Deal with it.
+	 mov	r6,r2
 
 3:	! Handle different src and dest alignments.
 	! This is not common, so simple byte by byte copy will do.
author
#1 lore raw

It's been about a week since I posted this bug report, and I haven't gotten any responses. Is there someone I should contact directly? Can someone please point me in the right direction?

Thanks,
Ollie

Quoted 26 lines · Ollie Wild

There's a bug in Hitachi SuperH csum_partial_copy_generic() implementation. If the supplied length is 1 (and several alignment conditions are met), the function immediately branches to label 4. However, the assembly at label 4 expects the length to be stored in register r2. Since this has not occurred, subsequent behavior is undefined.

This can cause bad payload checksums in TCP connections.

I've fixed the problem by initializing register r2 prior to the branch instruction.

Ollie

------------------------------------------------------------------------

arch/sh/lib/checksum.S +2 -1
@@ -202,8 +202,9 @@ ENTRY(csum_partial_copy_generic)
 	cmp/pz	r6		! Jump if we had at least two bytes.
 	bt/s	1f
 	 clrt
+	add	#2,r6		! r6 was < 2.	Deal with it.
 	bra	4f
-	 add	#2,r6		! r6 was < 2.	Deal with it.
+	 mov	r6,r2

3: ! Handle different src and dest alignments.
! This is not common, so simple byte by byte copy will do.

#2 lore raw
Quoted 3 lines · Ollie Wild

It's been about a week since I posted this bug report, and I haven't gotten any responses. Is there someone I should contact directly? Can someone please point me in the right direction?

The MAINTAINERS file in the kernel sources contains the following contact information for the sh port:

SUPERH (sh)

P:      Paul Mundt
M:      [email protected]
P:      Kazumoto Kojima
M:      [email protected]
L:      [email protected]
W:      http://www.linux-sh.org
W:      http://www.m17n.org/linux-sh/
W:      http://www.rr.iij4u.or.jp/~kkojima/linux-sh4.html
S:      Maintained
Quoted 3 lines

Thanks,
Ollie
...

cu
Adrian

Signature · 4 lines
       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed
author
#3 lore raw
Quoted 10 lines · Adrian Bunk
Quoted 3 lines · Ollie Wild

It's been about a week since I posted this bug report, and I haven't gotten any responses. Is there someone I should contact directly? Can someone please point me in the right direction?

The MAINTAINERS file in the kernel sources contains the following contact information for the sh port:

Thanks.

Ollie