From patchwork Tue Feb 14 10:32:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 13139813 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D080EC61DA4 for ; Tue, 14 Feb 2023 10:33:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=1253+K2S+rAkBDNy6zVwxDlP+ev6vGT3ubvBOcXkRnw=; b=27SARLY/QRNsCY LqR4B8xwE9G10phWzs1Um/RZg3LB3K4XMKqLd9XP1yapo2LPaDsgDDODbRS20+nVAmmVfzTRwubdg akIa+34Wtqk7nP7VSosqNzA87Uos8XirPRXom6DZw+0rUiKiZtNC+WRtH7Wc6oqYFWsn6sNom0FFD 8S904u6h5Y1OJ2v+GHCvP5OHR3ZHb9OUd5/m3Wnn39c7nuH0vTYQn3yp/Qbf1j/JTlGaZzUns/qb6 FCOZ22TBOKeb0s6kU0CT6nnoBTOhsHWxom3k48GkLyRV+cn+u9vJJZZ5BUE9+jLZBvEaaN9J8wQi9 BJ3Jrn7FsaUqbwJmGotw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1pRsbu-00125Y-3v; Tue, 14 Feb 2023 10:32:30 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1pRsbq-00124H-HT for linux-arm-kernel@lists.infradead.org; Tue, 14 Feb 2023 10:32:27 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D1DC3614EA; Tue, 14 Feb 2023 10:32:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2061C433EF; Tue, 14 Feb 2023 10:32:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1676370745; bh=QKVpoLD8wVqdCgKWH7wd37asoN5e+iUvQwCs7hR4hXM=; h=From:To:Cc:Subject:Date:From; b=Sw7D+yEHbygy5LQ1x6KbfnsfhpAWSBJthuVToOYCL+NWxUJrCO/OpuKQCx5shulDf TooP8bFpjDX45smjOr9V7/lgh0Mc2aCheLUadTmmHpd8ugoM0/jFMLj5DfJqUo3R6o YrUnG7zz59gQo9SK4vIm93miV2Bvu6fi3neva8nNmSp6NODIIPEZIL4gHFcryT2xra /5jBS8x20M9MERZHHkaKRMFwWajvPYszSzOyqP7wbGzSHU1odhMERPwWmaDqLMYffo NWCDq/4b71vV+9OAiVCrhWZ1nxDYsnblsM2yTKIOYpBv13ASVzJpFbem16fYi2IhMM V4fCqfFiiSk+g== From: Arnd Bergmann To: Vinod Koul , Maxime Coquelin , Alexandre Torgue , Amelie Delaunay , Pierre Yves MORDRET , "M'boumba Cedric Madianga" Cc: Arnd Bergmann , dmaengine@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] dmaengine: stm32-dma: avoid bitfield overflow assertion Date: Tue, 14 Feb 2023 11:32:13 +0100 Message-Id: <20230214103222.1193307-1-arnd@kernel.org> X-Mailer: git-send-email 2.39.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230214_023226_685787_1DD85D94 X-CRM114-Status: GOOD ( 15.81 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Arnd Bergmann stm32_dma_get_burst() returns a negative error code for invalid input, which gets turned into a large u32 value in stm32_dma_prep_dma_memcpy() that in turn triggers an assertion because it does not fit into a two-bit field: drivers/dma/stm32-dma.c: In function 'stm32_dma_prep_dma_memcpy': include/linux/compiler_types.h:399:38: error: call to '__compiletime_assert_310' declared with attribute error: FIELD_PREP: value too large for the field 399 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^ include/linux/compiler_types.h:380:4: note: in definition of macro '__compiletime_assert' 380 | prefix ## suffix(); \ | ^~~~~~ include/linux/compiler_types.h:399:2: note: in expansion of macro '_compiletime_assert' 399 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) | ^~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:68:3: note: in expansion of macro 'BUILD_BUG_ON_MSG' 68 | BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ? \ | ^~~~~~~~~~~~~~~~ include/linux/bitfield.h:114:3: note: in expansion of macro '__BF_FIELD_CHECK' 114 | __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: "); \ | ^~~~~~~~~~~~~~~~ drivers/dma/stm32-dma.c:1273:4: note: in expansion of macro 'FIELD_PREP' 1273 | FIELD_PREP(STM32_DMA_SCR_PBURST_MASK, dma_burst) | | ^~~~~~~~~~ I only see this with older gcc versions like gcc-6.5 or gcc-9.5 but not with gcc-12.2 or higher. My best guess is that this is the result of changes to __builtin_constant_p(), which seems to treat the 'cold' codepath after an error message as a constant branch, while in newer gcc versions the range check is skipped after determining that dma_burst is never a compile-time constant. As an easy workaround, assume the error can happen, so try to handle this by failing stm32_dma_prep_dma_memcpy() before the assertion. Fixes: 1c32d6c37cc2 ("dmaengine: stm32-dma: use bitfield helpers") Fixes: a2b6103b7a8a ("dmaengine: stm32-dma: Improve memory burst management") Signed-off-by: Arnd Bergmann --- drivers/dma/stm32-dma.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c index 37674029cb42..e3cd4b0525e6 100644 --- a/drivers/dma/stm32-dma.c +++ b/drivers/dma/stm32-dma.c @@ -1266,6 +1266,10 @@ static struct dma_async_tx_descriptor *stm32_dma_prep_dma_memcpy( best_burst = stm32_dma_get_best_burst(len, STM32_DMA_MAX_BURST, threshold, max_width); dma_burst = stm32_dma_get_burst(chan, best_burst); + if (dma_burst > 3) { + kfree(desc); + return NULL; + } stm32_dma_clear_reg(&desc->sg_req[i].chan_reg); desc->sg_req[i].chan_reg.dma_scr =