diff mbox series

[v8,28/28] i2c: fix wild dereference

Message ID 20191128062442.20690-29-npiggin@gmail.com
State Superseded
Headers show
Series little endian skiboot | expand

Checks

Context Check Description
snowpatch_ozlabs/apply_patch warning Failed to apply on branch master (d75e82dbfbb9443efeb3f9a5921ac23605aab469)
snowpatch_ozlabs/apply_patch fail Failed to apply to any branch

Commit Message

Nicholas Piggin Nov. 28, 2019, 6:24 a.m. UTC
The contents of the buffer is not initialized in the case of a read,
and not even necessarily at least 8 bytes long. It seems like the
address is what's wanted.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 core/i2c.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Oliver O'Halloran Nov. 28, 2019, 7:10 a.m. UTC | #1
On Thu, Nov 28, 2019 at 5:35 PM Nicholas Piggin <npiggin@gmail.com> wrote:
>
> The contents of the buffer is not initialized in the case of a read,
> and not even necessarily at least 8 bytes long. It seems like the
> address is what's wanted.

Nah, it's the data that is interesting. Most I2C transactions are only
a few bytes and op->rw_len indicates how much of that 8 bytes is
actually valid. It's a bit of a dumb hack, but it is an occasionally
useful one.


> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> ---
>  core/i2c.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/core/i2c.c b/core/i2c.c
> index 6bae83b42..89231e5f9 100644
> --- a/core/i2c.c
> +++ b/core/i2c.c
> @@ -173,10 +173,10 @@ int64_t i2c_request_sync(struct i2c_request *req)
>                 req->req_state = i2c_req_new;
>         }
>
> -       prlog(PR_DEBUG, "I2C: %s req op=%x offset=%x buf=%016llx buflen=%d "
> +       prlog(PR_DEBUG, "I2C: %s req op=%x offset=%x buf=%p buflen=%d "
>               "delay=%lu/%lld rc=%lld\n",
>               (rc) ? "!!!!" : "----", req->op, req->offset,
> -             *(uint64_t*) req->rw_buf, req->rw_len, tb_to_msecs(waited), req->timeout, rc);
> +             req->rw_buf, req->rw_len, tb_to_msecs(waited), req->timeout, rc);
>
>         return rc;
>  }
> --
> 2.23.0
>
> _______________________________________________
> Skiboot mailing list
> Skiboot@lists.ozlabs.org
> https://lists.ozlabs.org/listinfo/skiboot
diff mbox series

Patch

diff --git a/core/i2c.c b/core/i2c.c
index 6bae83b42..89231e5f9 100644
--- a/core/i2c.c
+++ b/core/i2c.c
@@ -173,10 +173,10 @@  int64_t i2c_request_sync(struct i2c_request *req)
 		req->req_state = i2c_req_new;
 	}
 
-	prlog(PR_DEBUG, "I2C: %s req op=%x offset=%x buf=%016llx buflen=%d "
+	prlog(PR_DEBUG, "I2C: %s req op=%x offset=%x buf=%p buflen=%d "
 	      "delay=%lu/%lld rc=%lld\n",
 	      (rc) ? "!!!!" : "----", req->op, req->offset,
-	      *(uint64_t*) req->rw_buf, req->rw_len, tb_to_msecs(waited), req->timeout, rc);
+	      req->rw_buf, req->rw_len, tb_to_msecs(waited), req->timeout, rc);
 
 	return rc;
 }