Re: mvpcie(4): fix panic if "reset-gpios" is not available
On Mon, Feb 14, 2022 at 12:00:24PM +1100, Jonathan Gray wrote: > On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote: > > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > > currently causes a panic: > > > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > > > Below is a fix. > > > > There are more of these: > > > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > > > where glen and slen are size_t and Thanks. ok > > Index: ofw_regulator.c > === > RCS file: /cvs/src/sys/dev/ofw/ofw_regulator.c,v > retrieving revision 1.15 > diff -u -p -r1.15 ofw_regulator.c > --- ofw_regulator.c 23 Dec 2020 11:58:36 - 1.15 > +++ ofw_regulator.c 14 Feb 2022 00:55:28 - > @@ -328,8 +328,7 @@ regulator_gpio_get(int node) > { > uint32_t *gpio, *gpios, *states; > uint32_t idx, value; > - size_t glen, slen; > - int i; > + int glen, slen, i; > > pinctrl_byname(node, "default"); > > @@ -377,10 +376,9 @@ int > regulator_gpio_set(int node, uint32_t value) > { > uint32_t *gpio, *gpios, *states; > - size_t glen, slen; > uint32_t min, max; > uint32_t idx; > - int i; > + int glen, slen, i; > > pinctrl_byname(node, "default"); >
Re: mvpcie(4): fix panic if "reset-gpios" is not available
On Mon, Feb 14, 2022 at 12:00:24PM +1100, Jonathan Gray wrote: > On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote: > > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > > currently causes a panic: > > > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > > > Below is a fix. > > > > There are more of these: > > > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > > > where glen and slen are size_t and ok tobhe@ > > Index: ofw_regulator.c > === > RCS file: /cvs/src/sys/dev/ofw/ofw_regulator.c,v > retrieving revision 1.15 > diff -u -p -r1.15 ofw_regulator.c > --- ofw_regulator.c 23 Dec 2020 11:58:36 - 1.15 > +++ ofw_regulator.c 14 Feb 2022 00:55:28 - > @@ -328,8 +328,7 @@ regulator_gpio_get(int node) > { > uint32_t *gpio, *gpios, *states; > uint32_t idx, value; > - size_t glen, slen; > - int i; > + int glen, slen, i; > > pinctrl_byname(node, "default"); > > @@ -377,10 +376,9 @@ int > regulator_gpio_set(int node, uint32_t value) > { > uint32_t *gpio, *gpios, *states; > - size_t glen, slen; > uint32_t min, max; > uint32_t idx; > - int i; > + int glen, slen, i; > > pinctrl_byname(node, "default"); >
Re: mvpcie(4): fix panic if "reset-gpios" is not available
On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote: > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > currently causes a panic: > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > Below is a fix. > > There are more of these: > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) <= > 0) > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) <= > 0) > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) <= > 0) > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) <= > 0) > > where glen and slen are size_t and Index: ofw_regulator.c === RCS file: /cvs/src/sys/dev/ofw/ofw_regulator.c,v retrieving revision 1.15 diff -u -p -r1.15 ofw_regulator.c --- ofw_regulator.c 23 Dec 2020 11:58:36 - 1.15 +++ ofw_regulator.c 14 Feb 2022 00:55:28 - @@ -328,8 +328,7 @@ regulator_gpio_get(int node) { uint32_t *gpio, *gpios, *states; uint32_t idx, value; - size_t glen, slen; - int i; + int glen, slen, i; pinctrl_byname(node, "default"); @@ -377,10 +376,9 @@ int regulator_gpio_set(int node, uint32_t value) { uint32_t *gpio, *gpios, *states; - size_t glen, slen; uint32_t min, max; uint32_t idx; - int i; + int glen, slen, i; pinctrl_byname(node, "default");
Re: mvpcie(4): fix panic if "reset-gpios" is not available
> Date: Mon, 14 Feb 2022 01:41:45 +1100 > From: Jonathan Gray > > On Mon, Feb 14, 2022 at 01:31:57AM +1100, Jonathan Gray wrote: > > On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote: > > > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > > > currently causes a panic: > > > > > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > > > > > Below is a fix. > > > > > > There are more of these: > > > > > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) > > > <= 0) > > > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, > > > "states")) <= 0) > > > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) > > > <= 0) > > > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, > > > "states")) <= 0) > > > > > > where glen and slen are size_t and > > > > > > arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, > > > "available") + sizeof(struct mem_region); > > > > > > with a size_t sz. > > > > another in imxspi > > some more > > ssdfb.c has a size_t sc_gpiolen but stores the > result in a ssize_t and tests that before storing to it ok kettenis@ > Index: dev/fdt/simpleamp.c > === > RCS file: /cvs/src/sys/dev/fdt/simpleamp.c,v > retrieving revision 1.1 > diff -u -p -r1.1 simpleamp.c > --- dev/fdt/simpleamp.c 10 Jun 2020 23:59:07 - 1.1 > +++ dev/fdt/simpleamp.c 13 Feb 2022 14:35:09 - > @@ -42,7 +42,7 @@ struct simpleamp_softc { > struct dai_device sc_dai; > > uint32_t*sc_gpio; > - size_t sc_gpiolen; > + int sc_gpiolen; > uint32_tsc_vcc; > }; > > Index: arch/arm64/dev/aplhidev.c > === > RCS file: /cvs/src/sys/arch/arm64/dev/aplhidev.c,v > retrieving revision 1.4 > diff -u -p -r1.4 aplhidev.c > --- arch/arm64/dev/aplhidev.c 11 Dec 2021 20:36:26 - 1.4 > +++ arch/arm64/dev/aplhidev.c 13 Feb 2022 14:33:57 - > @@ -117,7 +117,7 @@ struct aplhidev_softc { > uint8_t sc_msgid; > > uint32_t*sc_gpio; > - size_t sc_gpiolen; > + int sc_gpiolen; > > struct device *sc_kbd; > uint8_t sc_kbddesc[APLHIDEV_DESC_MAX]; > >
Re: mvpcie(4): fix panic if "reset-gpios" is not available
> Date: Mon, 14 Feb 2022 01:31:57 +1100 > From: Jonathan Gray > > On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote: > > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > > currently causes a panic: > > > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > > > Below is a fix. > > > > There are more of these: > > > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > > > where glen and slen are size_t and > > > > arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, > > "available") + sizeof(struct mem_region); > > > > with a size_t sz. > > another in imxspi ok kettenis@ > Index: imxspi.c > === > RCS file: /cvs/src/sys/dev/fdt/imxspi.c,v > retrieving revision 1.3 > diff -u -p -r1.3 imxspi.c > --- imxspi.c 31 Oct 2021 15:12:00 - 1.3 > +++ imxspi.c 13 Feb 2022 14:21:01 - > @@ -91,7 +91,7 @@ struct imxspi_softc { > int sc_node; > > uint32_t*sc_gpio; > - size_t sc_gpiolen; > + int sc_gpiolen; > > struct rwlocksc_buslock; > struct spi_controllersc_tag; > @@ -179,7 +179,7 @@ imxspi_attachhook(struct device *self) > clock_enable(sc->sc_node, NULL); > > sc->sc_gpiolen = OF_getproplen(sc->sc_node, "cs-gpios"); > - if (sc->sc_gpiolen) { > + if (sc->sc_gpiolen > 0) { > sc->sc_gpio = malloc(sc->sc_gpiolen, M_DEVBUF, M_WAITOK); > OF_getpropintarray(sc->sc_node, "cs-gpios", > sc->sc_gpio, sc->sc_gpiolen); > >
Re: mvpcie(4): fix panic if "reset-gpios" is not available
On Mon, Feb 14, 2022 at 01:31:57AM +1100, Jonathan Gray wrote: > On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote: > > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > > currently causes a panic: > > > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > > > Below is a fix. > > > > There are more of these: > > > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) > > <= 0) > > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) > > <= 0) > > > > where glen and slen are size_t and > > > > arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, > > "available") + sizeof(struct mem_region); > > > > with a size_t sz. > > another in imxspi some more ssdfb.c has a size_t sc_gpiolen but stores the result in a ssize_t and tests that before storing to it Index: dev/fdt/simpleamp.c === RCS file: /cvs/src/sys/dev/fdt/simpleamp.c,v retrieving revision 1.1 diff -u -p -r1.1 simpleamp.c --- dev/fdt/simpleamp.c 10 Jun 2020 23:59:07 - 1.1 +++ dev/fdt/simpleamp.c 13 Feb 2022 14:35:09 - @@ -42,7 +42,7 @@ struct simpleamp_softc { struct dai_device sc_dai; uint32_t*sc_gpio; - size_t sc_gpiolen; + int sc_gpiolen; uint32_tsc_vcc; }; Index: arch/arm64/dev/aplhidev.c === RCS file: /cvs/src/sys/arch/arm64/dev/aplhidev.c,v retrieving revision 1.4 diff -u -p -r1.4 aplhidev.c --- arch/arm64/dev/aplhidev.c 11 Dec 2021 20:36:26 - 1.4 +++ arch/arm64/dev/aplhidev.c 13 Feb 2022 14:33:57 - @@ -117,7 +117,7 @@ struct aplhidev_softc { uint8_t sc_msgid; uint32_t*sc_gpio; - size_t sc_gpiolen; + int sc_gpiolen; struct device *sc_kbd; uint8_t sc_kbddesc[APLHIDEV_DESC_MAX];
Re: mvpcie(4): fix panic if "reset-gpios" is not available
> Date: Sun, 13 Feb 2022 14:30:21 +0100 > From: Tobias Heider > > OF_getproplen() will return -1 if "reset-gpios" is not found which > currently causes a panic: > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > Below is a fix. > > ok? ok kettenis@ > Index: mvpcie.c > === > RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v > retrieving revision 1.5 > diff -u -p -r1.5 mvpcie.c > --- mvpcie.c 24 Oct 2021 17:52:27 - 1.5 > +++ mvpcie.c 13 Feb 2022 13:24:17 - > @@ -106,7 +106,7 @@ struct mvpcie_port { > int po_fn; > > uint32_t*po_gpio; > - size_t po_gpiolen; > + int po_gpiolen; > > struct arm32_pci_chipset po_pc; > int po_bus; > @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc * > po->po_bridge_iolimit = 1; > > po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios"); > - if (po->po_gpiolen) { > + if (po->po_gpiolen > 0) { > po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK); > OF_getpropintarray(po->po_node, "reset-gpios", > po->po_gpio, po->po_gpiolen); > >
Re: mvpcie(4): fix panic if "reset-gpios" is not available
On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote: > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > currently causes a panic: > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > Below is a fix. > > There are more of these: > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) <= > 0) > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) <= > 0) > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) <= > 0) > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) <= > 0) > > where glen and slen are size_t and > > arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, "available") > + sizeof(struct mem_region); > > with a size_t sz. another in imxspi Index: imxspi.c === RCS file: /cvs/src/sys/dev/fdt/imxspi.c,v retrieving revision 1.3 diff -u -p -r1.3 imxspi.c --- imxspi.c31 Oct 2021 15:12:00 - 1.3 +++ imxspi.c13 Feb 2022 14:21:01 - @@ -91,7 +91,7 @@ struct imxspi_softc { int sc_node; uint32_t*sc_gpio; - size_t sc_gpiolen; + int sc_gpiolen; struct rwlocksc_buslock; struct spi_controllersc_tag; @@ -179,7 +179,7 @@ imxspi_attachhook(struct device *self) clock_enable(sc->sc_node, NULL); sc->sc_gpiolen = OF_getproplen(sc->sc_node, "cs-gpios"); - if (sc->sc_gpiolen) { + if (sc->sc_gpiolen > 0) { sc->sc_gpio = malloc(sc->sc_gpiolen, M_DEVBUF, M_WAITOK); OF_getpropintarray(sc->sc_node, "cs-gpios", sc->sc_gpio, sc->sc_gpiolen);
Re: mvpcie(4): fix panic if "reset-gpios" is not available
On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > OF_getproplen() will return -1 if "reset-gpios" is not found which > currently causes a panic: > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > Below is a fix. There are more of these: dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) <= 0) dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) <= 0) dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) <= 0) dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) <= 0) where glen and slen are size_t and arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, "available") + sizeof(struct mem_region); with a size_t sz. > > ok? > > Index: mvpcie.c > === > RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v > retrieving revision 1.5 > diff -u -p -r1.5 mvpcie.c > --- mvpcie.c 24 Oct 2021 17:52:27 - 1.5 > +++ mvpcie.c 13 Feb 2022 13:24:17 - > @@ -106,7 +106,7 @@ struct mvpcie_port { > int po_fn; > > uint32_t*po_gpio; > - size_t po_gpiolen; > + int po_gpiolen; > > struct arm32_pci_chipset po_pc; > int po_bus; > @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc * > po->po_bridge_iolimit = 1; > > po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios"); > - if (po->po_gpiolen) { > + if (po->po_gpiolen > 0) { > po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK); > OF_getpropintarray(po->po_node, "reset-gpios", > po->po_gpio, po->po_gpiolen); >
Re: mvpcie(4): fix panic if "reset-gpios" is not available
Am Sun, Feb 13, 2022 at 01:39:22PM + schrieb Klemens Nanni: > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > > OF_getproplen() will return -1 if "reset-gpios" is not found which > > currently causes a panic: > > > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > > > Below is a fix. > > > > ok? > > OK kn ok patrick@ as well > > > > Index: mvpcie.c > > === > > RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v > > retrieving revision 1.5 > > diff -u -p -r1.5 mvpcie.c > > --- mvpcie.c24 Oct 2021 17:52:27 - 1.5 > > +++ mvpcie.c13 Feb 2022 13:24:17 - > > @@ -106,7 +106,7 @@ struct mvpcie_port { > > int po_fn; > > > > uint32_t*po_gpio; > > - size_t po_gpiolen; > > + int po_gpiolen; > > > > struct arm32_pci_chipset po_pc; > > int po_bus; > > @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc * > > po->po_bridge_iolimit = 1; > > > > po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios"); > > - if (po->po_gpiolen) { > > + if (po->po_gpiolen > 0) { > > po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK); > > OF_getpropintarray(po->po_node, "reset-gpios", > > po->po_gpio, po->po_gpiolen); > > >
Re: mvpcie(4): fix panic if "reset-gpios" is not available
On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote: > OF_getproplen() will return -1 if "reset-gpios" is not found which > currently causes a panic: > > panic: malloc: allocation too large, type = 2, size = 4294967295 > > Below is a fix. > > ok? OK kn > > Index: mvpcie.c > === > RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v > retrieving revision 1.5 > diff -u -p -r1.5 mvpcie.c > --- mvpcie.c 24 Oct 2021 17:52:27 - 1.5 > +++ mvpcie.c 13 Feb 2022 13:24:17 - > @@ -106,7 +106,7 @@ struct mvpcie_port { > int po_fn; > > uint32_t*po_gpio; > - size_t po_gpiolen; > + int po_gpiolen; > > struct arm32_pci_chipset po_pc; > int po_bus; > @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc * > po->po_bridge_iolimit = 1; > > po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios"); > - if (po->po_gpiolen) { > + if (po->po_gpiolen > 0) { > po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK); > OF_getpropintarray(po->po_node, "reset-gpios", > po->po_gpio, po->po_gpiolen); >
mvpcie(4): fix panic if "reset-gpios" is not available
OF_getproplen() will return -1 if "reset-gpios" is not found which currently causes a panic: panic: malloc: allocation too large, type = 2, size = 4294967295 Below is a fix. ok? Index: mvpcie.c === RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v retrieving revision 1.5 diff -u -p -r1.5 mvpcie.c --- mvpcie.c24 Oct 2021 17:52:27 - 1.5 +++ mvpcie.c13 Feb 2022 13:24:17 - @@ -106,7 +106,7 @@ struct mvpcie_port { int po_fn; uint32_t*po_gpio; - size_t po_gpiolen; + int po_gpiolen; struct arm32_pci_chipset po_pc; int po_bus; @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc * po->po_bridge_iolimit = 1; po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios"); - if (po->po_gpiolen) { + if (po->po_gpiolen > 0) { po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK); OF_getpropintarray(po->po_node, "reset-gpios", po->po_gpio, po->po_gpiolen);