| Message ID | 20210915103659.GB7060@kili (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() | expand |
Le 15/09/2021 à 12:36, Dan Carpenter a écrit : > This is writing to the first 1 - 3 bytes of "len" and then writing all > four bytes to musb_writel(). The last byte is always going to be > garbage. Zero out the last bytes instead. > > Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/usb/musb/tusb6010.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c > index c42937692207..c510fb84faa6 100644 > --- a/drivers/usb/musb/tusb6010.c > +++ b/drivers/usb/musb/tusb6010.c > @@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len) > } > if (len > 0) { > /* Write the rest 1 - 3 bytes to FIFO */ > + len = 0; + val = 0; ? > memcpy(&val, buf, len); > musb_writel(fifo, 0, val); > } > CJ
On Wed, Sep 15, 2021 at 07:49:40PM +0200, Christophe JAILLET wrote: > Le 15/09/2021 à 12:36, Dan Carpenter a écrit : > > This is writing to the first 1 - 3 bytes of "len" and then writing all > > four bytes to musb_writel(). The last byte is always going to be > > garbage. Zero out the last bytes instead. > > > > Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support") > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > --- > > drivers/usb/musb/tusb6010.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c > > index c42937692207..c510fb84faa6 100644 > > --- a/drivers/usb/musb/tusb6010.c > > +++ b/drivers/usb/musb/tusb6010.c > > @@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len) > > } > > if (len > 0) { > > /* Write the rest 1 - 3 bytes to FIFO */ > > + len = 0; > > + val = 0; > ? Wow. Duh! My goodness... Thanks for catching that. regards, dan carpenter
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c index c42937692207..c510fb84faa6 100644 --- a/drivers/usb/musb/tusb6010.c +++ b/drivers/usb/musb/tusb6010.c @@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len) } if (len > 0) { /* Write the rest 1 - 3 bytes to FIFO */ + len = 0; memcpy(&val, buf, len); musb_writel(fifo, 0, val); }
This is writing to the first 1 - 3 bytes of "len" and then writing all four bytes to musb_writel(). The last byte is always going to be garbage. Zero out the last bytes instead. Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/usb/musb/tusb6010.c | 1 + 1 file changed, 1 insertion(+)