Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-22 Thread Wenwen Wang
On Mon, Oct 22, 2018 at 3:04 AM Mika Westerberg wrote: > > Hi, > > On Sat, Oct 20, 2018 at 12:55:51PM -0500, Wenwen Wang wrote: > > In tb_ctl_rx_callback(), the checksum of the received control packet is > > calculated on 'pkg->buffer' through tb_crc() and saved to 'crc32', Then, > > 'crc32' is

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-22 Thread Wenwen Wang
On Mon, Oct 22, 2018 at 3:04 AM Mika Westerberg wrote: > > Hi, > > On Sat, Oct 20, 2018 at 12:55:51PM -0500, Wenwen Wang wrote: > > In tb_ctl_rx_callback(), the checksum of the received control packet is > > calculated on 'pkg->buffer' through tb_crc() and saved to 'crc32', Then, > > 'crc32' is

Re: [PATCH] thunderbolt: fix a missing-check bug

2018-10-22 Thread Mika Westerberg
On Sat, Oct 20, 2018 at 03:15:56PM -0500, Wenwen Wang wrote: > In tb_ring_poll(), the flag of the frame, i.e., > 'ring->descriptors[ring->tail].flags', is checked to see whether the frame > is completed. If yes, the frame including the flag will be read from the > ring and returned to the caller.

Re: [PATCH] thunderbolt: fix a missing-check bug

2018-10-22 Thread Mika Westerberg
On Sat, Oct 20, 2018 at 03:15:56PM -0500, Wenwen Wang wrote: > In tb_ring_poll(), the flag of the frame, i.e., > 'ring->descriptors[ring->tail].flags', is checked to see whether the frame > is completed. If yes, the frame including the flag will be read from the > ring and returned to the caller.

Re: [PATCH] thunderbolt: fix a missing-check bug

2018-10-22 Thread Mika Westerberg
On Sat, Oct 20, 2018 at 02:47:49PM -0500, Wenwen Wang wrote: > In ring_work(), the first while loop is used to collect all completed > frames from the ring buffer. In each iteration of this loop, the flag of > the frame, i.e., 'ring->descriptors[ring->tail].flags' is firstly check to > see whether

Re: [PATCH] thunderbolt: fix a missing-check bug

2018-10-22 Thread Mika Westerberg
On Sat, Oct 20, 2018 at 02:47:49PM -0500, Wenwen Wang wrote: > In ring_work(), the first while loop is used to collect all completed > frames from the ring buffer. In each iteration of this loop, the flag of > the frame, i.e., 'ring->descriptors[ring->tail].flags' is firstly check to > see whether

Re: [PATCH] thunderbolt: fix a missing-check bug

2018-10-22 Thread Mika Westerberg
Hi, On Sat, Oct 20, 2018 at 01:38:18PM -0500, Wenwen Wang wrote: > In icm_copy(), the packet id 'hdr->packet_id' is firstly compared against > 'req->npackets'. If it is less than 'req->npackets', the received packet. > i.e., 'pkg->buffer', is then copied to 'req->response + offset' through >

Re: [PATCH] thunderbolt: fix a missing-check bug

2018-10-22 Thread Mika Westerberg
Hi, On Sat, Oct 20, 2018 at 01:38:18PM -0500, Wenwen Wang wrote: > In icm_copy(), the packet id 'hdr->packet_id' is firstly compared against > 'req->npackets'. If it is less than 'req->npackets', the received packet. > i.e., 'pkg->buffer', is then copied to 'req->response + offset' through >

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-22 Thread Mika Westerberg
Hi, On Sat, Oct 20, 2018 at 12:55:51PM -0500, Wenwen Wang wrote: > In tb_ctl_rx_callback(), the checksum of the received control packet is > calculated on 'pkg->buffer' through tb_crc() and saved to 'crc32', Then, > 'crc32' is compared with the received checksum to confirm the integrity of > the

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-22 Thread Mika Westerberg
Hi, On Sat, Oct 20, 2018 at 12:55:51PM -0500, Wenwen Wang wrote: > In tb_ctl_rx_callback(), the checksum of the received control packet is > calculated on 'pkg->buffer' through tb_crc() and saved to 'crc32', Then, > 'crc32' is compared with the received checksum to confirm the integrity of > the

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-22 Thread Mika Westerberg
On Fri, Oct 19, 2018 at 04:25:01PM -0500, Wenwen Wang wrote: > Hi Mika, Hi, > Thanks for your response. The current version of the code assumes that > the Thunderbolt controller behaves as expected, e.g., the host > controller should not touch the data after it is marked ready. > However, it is

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-22 Thread Mika Westerberg
On Fri, Oct 19, 2018 at 04:25:01PM -0500, Wenwen Wang wrote: > Hi Mika, Hi, > Thanks for your response. The current version of the code assumes that > the Thunderbolt controller behaves as expected, e.g., the host > controller should not touch the data after it is marked ready. > However, it is

[PATCH] thunderbolt: fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In tb_ring_poll(), the flag of the frame, i.e., 'ring->descriptors[ring->tail].flags', is checked to see whether the frame is completed. If yes, the frame including the flag will be read from the ring and returned to the caller. The problem here is that the flag is actually in a DMA region, which

[PATCH] thunderbolt: fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In tb_ring_poll(), the flag of the frame, i.e., 'ring->descriptors[ring->tail].flags', is checked to see whether the frame is completed. If yes, the frame including the flag will be read from the ring and returned to the caller. The problem here is that the flag is actually in a DMA region, which

[PATCH] thunderbolt: fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In ring_work(), the first while loop is used to collect all completed frames from the ring buffer. In each iteration of this loop, the flag of the frame, i.e., 'ring->descriptors[ring->tail].flags' is firstly check to see whether the frame is completed. If yes, the descriptor of the frame,

[PATCH] thunderbolt: fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In ring_work(), the first while loop is used to collect all completed frames from the ring buffer. In each iteration of this loop, the flag of the frame, i.e., 'ring->descriptors[ring->tail].flags' is firstly check to see whether the frame is completed. If yes, the descriptor of the frame,

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-20 Thread Yehezkel Bernat
On Sat, Oct 20, 2018 at 12:25 AM Wenwen Wang wrote: > > On Thu, Oct 18, 2018 at 4:13 AM Mika Westerberg > wrote: > > > > Hi Wenwen, > > > > On Wed, Oct 17, 2018 at 09:00:29AM -0500, Wenwen Wang wrote: > > > In tb_cfg_copy(), the header of the received control package, which is in > > > the

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-20 Thread Yehezkel Bernat
On Sat, Oct 20, 2018 at 12:25 AM Wenwen Wang wrote: > > On Thu, Oct 18, 2018 at 4:13 AM Mika Westerberg > wrote: > > > > Hi Wenwen, > > > > On Wed, Oct 17, 2018 at 09:00:29AM -0500, Wenwen Wang wrote: > > > In tb_cfg_copy(), the header of the received control package, which is in > > > the

[PATCH] thunderbolt: fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In icm_copy(), the packet id 'hdr->packet_id' is firstly compared against 'req->npackets'. If it is less than 'req->npackets', the received packet. i.e., 'pkg->buffer', is then copied to 'req->response + offset' through memcpy(). It is worth noting that 'offset' is also calculated based on

[PATCH] thunderbolt: fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In icm_copy(), the packet id 'hdr->packet_id' is firstly compared against 'req->npackets'. If it is less than 'req->npackets', the received packet. i.e., 'pkg->buffer', is then copied to 'req->response + offset' through memcpy(). It is worth noting that 'offset' is also calculated based on

[PATCH] thunderbolt: Fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In tb_ctl_rx_callback(), the checksum of the received control packet is calculated on 'pkg->buffer' through tb_crc() and saved to 'crc32', Then, 'crc32' is compared with the received checksum to confirm the integrity of the received packet. If the checksum does not match, the packet will be

[PATCH] thunderbolt: Fix a missing-check bug

2018-10-20 Thread Wenwen Wang
In tb_ctl_rx_callback(), the checksum of the received control packet is calculated on 'pkg->buffer' through tb_crc() and saved to 'crc32', Then, 'crc32' is compared with the received checksum to confirm the integrity of the received packet. If the checksum does not match, the packet will be

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-19 Thread Wenwen Wang
On Thu, Oct 18, 2018 at 4:13 AM Mika Westerberg wrote: > > Hi Wenwen, > > On Wed, Oct 17, 2018 at 09:00:29AM -0500, Wenwen Wang wrote: > > In tb_cfg_copy(), the header of the received control package, which is in > > the buffer 'pkg->buffer', is firstly parsed through parse_header() to make > >

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-19 Thread Wenwen Wang
On Thu, Oct 18, 2018 at 4:13 AM Mika Westerberg wrote: > > Hi Wenwen, > > On Wed, Oct 17, 2018 at 09:00:29AM -0500, Wenwen Wang wrote: > > In tb_cfg_copy(), the header of the received control package, which is in > > the buffer 'pkg->buffer', is firstly parsed through parse_header() to make > >

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-18 Thread Mika Westerberg
Hi Wenwen, On Wed, Oct 17, 2018 at 09:00:29AM -0500, Wenwen Wang wrote: > In tb_cfg_copy(), the header of the received control package, which is in > the buffer 'pkg->buffer', is firstly parsed through parse_header() to make > sure the header is in the expected format. In parse_header(), the

Re: [PATCH] thunderbolt: Fix a missing-check bug

2018-10-18 Thread Mika Westerberg
Hi Wenwen, On Wed, Oct 17, 2018 at 09:00:29AM -0500, Wenwen Wang wrote: > In tb_cfg_copy(), the header of the received control package, which is in > the buffer 'pkg->buffer', is firstly parsed through parse_header() to make > sure the header is in the expected format. In parse_header(), the

[PATCH] thunderbolt: Fix a missing-check bug

2018-10-17 Thread Wenwen Wang
In tb_cfg_copy(), the header of the received control package, which is in the buffer 'pkg->buffer', is firstly parsed through parse_header() to make sure the header is in the expected format. In parse_header(), the header is actually checked by invoking check_header(), which checks the 'unknown'

[PATCH] thunderbolt: Fix a missing-check bug

2018-10-17 Thread Wenwen Wang
In tb_cfg_copy(), the header of the received control package, which is in the buffer 'pkg->buffer', is firstly parsed through parse_header() to make sure the header is in the expected format. In parse_header(), the header is actually checked by invoking check_header(), which checks the 'unknown'