From patchwork Tue Feb 14 10:32:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 56830 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2891310wrn; Tue, 14 Feb 2023 02:40:12 -0800 (PST) X-Google-Smtp-Source: AK7set/QrcDqsanQiefHuxirYlf/NpeU++8JEeq+aOhtaVgBTGYPd743N2ML6TtOARYeFF4QisvP X-Received: by 2002:a17:902:ce85:b0:19a:6b55:a453 with SMTP id f5-20020a170902ce8500b0019a6b55a453mr1768393plg.9.1676371211569; Tue, 14 Feb 2023 02:40:11 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1676371211; cv=none; d=google.com; s=arc-20160816; b=VrrWfM4O9EHWosZH5dRKK5RslNCKx5BzCcy9hx7BVEFsjrqPy+kLkFkynCZPamhOWj 0yjKwlPC5r2e3zDwG30XOz4hCQxkwCbioGwnGtNMihniFntAcBOefH9zQ5XhJve+IAKz YJc0bZCBGn1W4qlbeokAad8CiQFvE67AMu3C4kOBSEuXkKW8MXkNZePtg8P8uXgHPIyG aPn34aa+23hs9bkLgt9ERMHv3GeURFJiLxff8o6EZ8ktGw3pLx5rqmOx/P6OocVduqkL AOt4tOtL2zD6YP0OSIRYE9mryPRzNwsFoK8ptX24Zlbs+bcPO8DjlJBBAgdofbs8nN/O 6TFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=09HtW5dq2Y+0COotUh2i8s7kHK4gbq83xn9mYzWqINs=; b=XSVstMYn9KdTVGbnn2vLMRfQ4rpz+5NfMbUoDJLOVBGXGlaY/MVU89qq9qqmWBPTvZ 6CpUWTVJCSjBYm6cdye0Ko+CPKR0d7AnPYma06klW5Cs+zhnemieb9qdoUnUY5XvjHJa OKfBIvgqK3WpWzEdCE4GpkeiSeuVL6MKO6MY4G6ieQYXHFo4+CAzFSgF7Lh+6Q1Opo8W o93AbMFwdcAAjymOFjJI9qEhkYljmql5ulR6jAFZwZdkVHR0o6xDHlrlJ21TiDJfrNKR 6za2hkbNQowvuip1KN/jSibSyqynCTz3FO2yeaAUf/nJCVZBEzGP5r0kDui0wDVEFbB0 Y5cw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Sw7D+yEH; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id jd19-20020a170903261300b001993610cb43si6799501plb.343.2023.02.14.02.39.59; Tue, 14 Feb 2023 02:40:11 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Sw7D+yEH; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232431AbjBNKca (ORCPT + 99 others); Tue, 14 Feb 2023 05:32:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229742AbjBNKc2 (ORCPT ); Tue, 14 Feb 2023 05:32:28 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B96A4233DA; Tue, 14 Feb 2023 02:32:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 71191B8172F; Tue, 14 Feb 2023 10:32:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2061C433EF; Tue, 14 Feb 2023 10:32:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1676370745; bh=QKVpoLD8wVqdCgKWH7wd37asoN5e+iUvQwCs7hR4hXM=; h=From:To:Cc:Subject:Date:From; b=Sw7D+yEHbygy5LQ1x6KbfnsfhpAWSBJthuVToOYCL+NWxUJrCO/OpuKQCx5shulDf TooP8bFpjDX45smjOr9V7/lgh0Mc2aCheLUadTmmHpd8ugoM0/jFMLj5DfJqUo3R6o YrUnG7zz59gQo9SK4vIm93miV2Bvu6fi3neva8nNmSp6NODIIPEZIL4gHFcryT2xra /5jBS8x20M9MERZHHkaKRMFwWajvPYszSzOyqP7wbGzSHU1odhMERPwWmaDqLMYffo NWCDq/4b71vV+9OAiVCrhWZ1nxDYsnblsM2yTKIOYpBv13ASVzJpFbem16fYi2IhMM V4fCqfFiiSk+g== From: Arnd Bergmann To: Vinod Koul , Maxime Coquelin , Alexandre Torgue , Amelie Delaunay , Pierre Yves MORDRET , "M'boumba Cedric Madianga" Cc: Arnd Bergmann , dmaengine@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] dmaengine: stm32-dma: avoid bitfield overflow assertion Date: Tue, 14 Feb 2023 11:32:13 +0100 Message-Id: <20230214103222.1193307-1-arnd@kernel.org> X-Mailer: git-send-email 2.39.1 MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1757802619474166878?= X-GMAIL-MSGID: =?utf-8?q?1757802619474166878?= From: Arnd Bergmann stm32_dma_get_burst() returns a negative error code for invalid input, which gets turned into a large u32 value in stm32_dma_prep_dma_memcpy() that in turn triggers an assertion because it does not fit into a two-bit field: drivers/dma/stm32-dma.c: In function 'stm32_dma_prep_dma_memcpy': include/linux/compiler_types.h:399:38: error: call to '__compiletime_assert_310' declared with attribute error: FIELD_PREP: value too large for the field 399 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^ include/linux/compiler_types.h:380:4: note: in definition of macro '__compiletime_assert' 380 | prefix ## suffix(); \ | ^~~~~~ include/linux/compiler_types.h:399:2: note: in expansion of macro '_compiletime_assert' 399 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) | ^~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:68:3: note: in expansion of macro 'BUILD_BUG_ON_MSG' 68 | BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ? \ | ^~~~~~~~~~~~~~~~ include/linux/bitfield.h:114:3: note: in expansion of macro '__BF_FIELD_CHECK' 114 | __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: "); \ | ^~~~~~~~~~~~~~~~ drivers/dma/stm32-dma.c:1273:4: note: in expansion of macro 'FIELD_PREP' 1273 | FIELD_PREP(STM32_DMA_SCR_PBURST_MASK, dma_burst) | | ^~~~~~~~~~ I only see this with older gcc versions like gcc-6.5 or gcc-9.5 but not with gcc-12.2 or higher. My best guess is that this is the result of changes to __builtin_constant_p(), which seems to treat the 'cold' codepath after an error message as a constant branch, while in newer gcc versions the range check is skipped after determining that dma_burst is never a compile-time constant. As an easy workaround, assume the error can happen, so try to handle this by failing stm32_dma_prep_dma_memcpy() before the assertion. Fixes: 1c32d6c37cc2 ("dmaengine: stm32-dma: use bitfield helpers") Fixes: a2b6103b7a8a ("dmaengine: stm32-dma: Improve memory burst management") Signed-off-by: Arnd Bergmann --- drivers/dma/stm32-dma.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c index 37674029cb42..e3cd4b0525e6 100644 --- a/drivers/dma/stm32-dma.c +++ b/drivers/dma/stm32-dma.c @@ -1266,6 +1266,10 @@ static struct dma_async_tx_descriptor *stm32_dma_prep_dma_memcpy( best_burst = stm32_dma_get_best_burst(len, STM32_DMA_MAX_BURST, threshold, max_width); dma_burst = stm32_dma_get_burst(chan, best_burst); + if (dma_burst > 3) { + kfree(desc); + return NULL; + } stm32_dma_clear_reg(&desc->sg_req[i].chan_reg); desc->sg_req[i].chan_reg.dma_scr =