d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix undefined behaviour in the USB controllers

Browse Source 
The USB controller drivers assume they can cast a NULL pointer to a
struct and find the address of a member. KUBSan complains about this so
replace with the __offsetof and __containerof macros that use either a
builtin function where available, or the same NULL pointer on older
compilers without the builtin.

Reviewers: hselasky

Subscribers: imp

Reviewed by:	hselasky
Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D33865
This commit is contained in:
Andrew Turner 2021-12-29 12:10:49 +00:00
parent dfb1c97ab9
commit a3cea15680
6 changed files with 11 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/dev/usb/controller/atmegadci.c
View File

@ -79,8 +79,7 @@
#include <dev/usb/controller/atmegadci.h>
#define ATMEGA_BUS2SC(bus) \
((struct atmegadci_softc *)(((uint8_t *)(bus)) - \
((uint8_t *)&(((struct atmegadci_softc *)0)->sc_bus))))
__containerof(bus, struct atmegadci_softc, sc_bus)
#define ATMEGA_PC2SC(pc) \
ATMEGA_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus)

3
sys/dev/usb/controller/avr32dci.c
View File

@ -78,8 +78,7 @@
#include <dev/usb/controller/avr32dci.h>
#define AVR32_BUS2SC(bus) \
((struct avr32dci_softc *)(((uint8_t *)(bus)) - \
((uint8_t *)&(((struct avr32dci_softc *)0)->sc_bus))))
__containerof(bus, struct avr32dci_softc, sc_bus)
#define AVR32_PC2SC(pc) \
AVR32_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus)

3
sys/dev/usb/controller/dwc_otg.c
View File

@ -90,8 +90,7 @@
#include <dev/usb/controller/dwc_otgreg.h>
#define DWC_OTG_BUS2SC(bus) \
((struct dwc_otg_softc *)(((uint8_t *)(bus)) - \
((uint8_t *)&(((struct dwc_otg_softc *)0)->sc_bus))))
__containerof(bus, struct dwc_otg_softc, sc_bus)
#define DWC_OTG_PC2UDEV(pc) \
(USB_DMATAG_TO_XROOT((pc)->tag_parent)->udev)

3
sys/dev/usb/controller/musb_otg.c
View File

@ -82,8 +82,7 @@
#define MUSBOTG_INTR_ENDPT 1
#define MUSBOTG_BUS2SC(bus) \
((struct musbotg_softc *)(((uint8_t *)(bus)) - \
USB_P2U(&(((struct musbotg_softc *)0)->sc_bus))))
__containerof(bus, struct musbotg_softc, sc_bus)
#define MUSBOTG_PC2SC(pc) \
MUSBOTG_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus)

3
sys/dev/usb/controller/uss820dci.c
View File

@ -77,8 +77,7 @@
#include <dev/usb/controller/uss820dci.h>
#define USS820_DCI_BUS2SC(bus) \
((struct uss820dci_softc *)(((uint8_t *)(bus)) - \
((uint8_t *)&(((struct uss820dci_softc *)0)->sc_bus))))
__containerof(bus, struct uss820dci_softc, sc_bus)
#define USS820_DCI_PC2SC(pc) \
USS820_DCI_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus)

12
sys/dev/usb/controller/xhci.c
View File

@ -281,7 +281,7 @@ xhci_reset_command_queue_locked(struct xhci_softc *sc)
/* set up command ring control base address */
addr = buf_res.physaddr;
phwr = buf_res.buffer;
addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_commands[0];
addr += __offsetof(struct xhci_hw_root, hwr_commands[0]);
DPRINTF("CRCR=0x%016llx\n", (unsigned long long)addr);
@ -337,7 +337,7 @@ xhci_start_controller(struct xhci_softc *sc)
memset(pdctxa, 0, sizeof(*pdctxa));
addr = buf_res.physaddr;
addr += (uintptr_t)&((struct xhci_dev_ctx_addr *)0)->qwSpBufPtr[0];
addr += __offsetof(struct xhci_dev_ctx_addr, qwSpBufPtr[0]);
/* slot 0 points to the table of scratchpad pointers */
pdctxa->qwBaaDevCtxAddr[0] = htole64(addr);
@ -368,7 +368,7 @@ xhci_start_controller(struct xhci_softc *sc)
phwr = buf_res.buffer;
addr = buf_res.physaddr;
addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_events[0];
addr += __offsetof(struct xhci_hw_root, hwr_events[0]);
/* reset hardware root structure */
memset(phwr, 0, sizeof(*phwr));
@ -408,7 +408,7 @@ xhci_start_controller(struct xhci_softc *sc)
/* set up command ring control base address */
addr = buf_res.physaddr;
addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_commands[0];
addr += __offsetof(struct xhci_hw_root, hwr_commands[0]);
DPRINTF("CRCR=0x%016llx\n", (unsigned long long)addr);
@ -1100,7 +1100,7 @@ xhci_interrupt_poll(struct xhci_softc *sc)
*/
addr = buf_res.physaddr;
addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_events[i];
addr += __offsetof(struct xhci_hw_root, hwr_events[i]);
/* try to clear busy bit */
addr |= XHCI_ERDP_LO_BUSY;
@ -1164,7 +1164,7 @@ retry:
usb_pc_cpu_flush(&sc->sc_hw.root_pc);
addr = buf_res.physaddr;
addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_commands[i];
addr += __offsetof(struct xhci_hw_root, hwr_commands[i]);
sc->sc_cmd_addr = htole64(addr);