From nobody Tue Feb 22 16:40:18 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id D76F319E0C05; Tue, 22 Feb 2022 16:40:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K34fB5hLRz3KDn; Tue, 22 Feb 2022 16:40:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1645548018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vm1muQqNJA5E6BKq6hqICuSvQFQp0oZ1+qa3MleGAzA=; b=SkWGSKgKry12rlaa9QrrHPz1NA59B0ekTh3CdTF0N0kp5LC6PafAvpfgJJ/RFQXJeiEm25 aTKOmK7a1oimhFAZ5crlhDyhFZxSZG7y8RCQXvmgAFGUJaAeJEeKngdz8j/2NdiJTmZSTD 6lojzZk3ywkFsq8eOYmyKccfYowjCJEAlGXMHc/hZCuxHY3KHQvfF2Dnyylj38+I50HTpe TVrhbgEgfWe6PrMXkjY0RmTT3XXW0XPrr6XifccMxk8J6g4uZ+shgSEKDjylgjD9mRgKRd pBEQz2G7e39aI/yT5Ho4KcDiXi7/Z6921FajZzHoGScC58LMSqHpoXdW41clrA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A46312788C; Tue, 22 Feb 2022 16:40:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 21MGeImt062096; Tue, 22 Feb 2022 16:40:18 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 21MGeI3R062087; Tue, 22 Feb 2022 16:40:18 GMT (envelope-from git) Date: Tue, 22 Feb 2022 16:40:18 GMT Message-Id: <202202221640.21MGeI3R062087@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Andrew Turner Subject: git: 24a205e32805 - stable/13 - Fix undefined behaviour in the USB controllers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: andrew X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 24a205e32805e7e6ee2b8ce564770772ff730d30 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1645548018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vm1muQqNJA5E6BKq6hqICuSvQFQp0oZ1+qa3MleGAzA=; b=Cash8E0RnQ5N8+YWPFSWUTu9xeemc9Kq5fcLWau2chrskSR1XqDMDBtoim44ERyqjxtfx/ NGB+4Nl2wS1WNNsC8WXXIkER2YS+bpAyi7AiTUcGLEhX/NkVGkRRlLTWLeRUku2yLuciZg LRrGyT2wr18VGJehyJMXgrgonLRtNAOPA/oTfFp7pc8httndOrd5T8uHmSEaKzCRBTJymN a7G6JOcZPMsOnMinlfBkFn/n3O9QjZwLRWo0M5AWZbjFOV5AiL2EmDcfiuskKF8yckEF+f JW2+Tjzuf4bBuFV+5IFf7tPpXKIWj5sVTvQeG94B9OpvcfH94QJSP7RR3UgCzw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1645548018; a=rsa-sha256; cv=none; b=UQ96VWU34rzw4WtNkEs6InolPoKevjJ2jebhLxf7rrhUP5evDjuwuxpzDwSn5cbsJmsxfj pcQyrzCcYtdvj8NH5XX5tflxxZwNEOBXiPAfPphO0sR0VQ3HN7T0H9f+lbLeKMkItjSRCe BWI9sUkho0p3L9bevVnDb4c71DDIAoQLGPglVqJuHq2DXZdORP1/Tfv7lHsZAz7OacdzFy /x3zXLg8jJzdWELNVeoAOKivf3UUm7uHUZ6B3NopGLYgjOwa+HQYrKQonNTgtvf4cnc6TV 84SSbYiHcnTYNVGL5Eo8eS3LBggL3fZR8BmPFzFGpQ76cXX8PEFKAsd7/dXJjg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by andrew: URL: https://cgit.FreeBSD.org/src/commit/?id=24a205e32805e7e6ee2b8ce564770772ff730d30 commit 24a205e32805e7e6ee2b8ce564770772ff730d30 Author: Andrew Turner AuthorDate: 2021-12-29 12:10:49 +0000 Commit: Andrew Turner CommitDate: 2022-02-22 16:23:07 +0000 Fix undefined behaviour in the USB controllers The USB controller drivers assume they can cast a NULL pointer to a struct and find the address of a member. KUBSan complains about this so replace with the __offsetof and __containerof macros that use either a builtin function where available, or the same NULL pointer on older compilers without the builtin. Reviewers: hselasky Subscribers: imp Reviewed by: hselasky Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D33865 (cherry picked from commit a3cea156801790d0bbbb4cd9bede0ece8742af82) --- sys/dev/usb/controller/atmegadci.c | 3 +-- sys/dev/usb/controller/avr32dci.c | 3 +-- sys/dev/usb/controller/dwc_otg.c | 3 +-- sys/dev/usb/controller/musb_otg.c | 3 +-- sys/dev/usb/controller/uss820dci.c | 3 +-- sys/dev/usb/controller/xhci.c | 12 ++++++------ 6 files changed, 11 insertions(+), 16 deletions(-) diff --git a/sys/dev/usb/controller/atmegadci.c b/sys/dev/usb/controller/atmegadci.c index 1f91948c4ccd..a52b8ef0c19c 100644 --- a/sys/dev/usb/controller/atmegadci.c +++ b/sys/dev/usb/controller/atmegadci.c @@ -79,8 +79,7 @@ #include #define ATMEGA_BUS2SC(bus) \ - ((struct atmegadci_softc *)(((uint8_t *)(bus)) - \ - ((uint8_t *)&(((struct atmegadci_softc *)0)->sc_bus)))) + __containerof(bus, struct atmegadci_softc, sc_bus) #define ATMEGA_PC2SC(pc) \ ATMEGA_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus) diff --git a/sys/dev/usb/controller/avr32dci.c b/sys/dev/usb/controller/avr32dci.c index eaf0f8261b92..d999f1982e9e 100644 --- a/sys/dev/usb/controller/avr32dci.c +++ b/sys/dev/usb/controller/avr32dci.c @@ -78,8 +78,7 @@ #include #define AVR32_BUS2SC(bus) \ - ((struct avr32dci_softc *)(((uint8_t *)(bus)) - \ - ((uint8_t *)&(((struct avr32dci_softc *)0)->sc_bus)))) + __containerof(bus, struct avr32dci_softc, sc_bus) #define AVR32_PC2SC(pc) \ AVR32_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus) diff --git a/sys/dev/usb/controller/dwc_otg.c b/sys/dev/usb/controller/dwc_otg.c index 421b95593b3a..869c44c3bb1a 100644 --- a/sys/dev/usb/controller/dwc_otg.c +++ b/sys/dev/usb/controller/dwc_otg.c @@ -90,8 +90,7 @@ #include #define DWC_OTG_BUS2SC(bus) \ - ((struct dwc_otg_softc *)(((uint8_t *)(bus)) - \ - ((uint8_t *)&(((struct dwc_otg_softc *)0)->sc_bus)))) + __containerof(bus, struct dwc_otg_softc, sc_bus) #define DWC_OTG_PC2UDEV(pc) \ (USB_DMATAG_TO_XROOT((pc)->tag_parent)->udev) diff --git a/sys/dev/usb/controller/musb_otg.c b/sys/dev/usb/controller/musb_otg.c index 24eba2a9a552..9dd24a837316 100644 --- a/sys/dev/usb/controller/musb_otg.c +++ b/sys/dev/usb/controller/musb_otg.c @@ -82,8 +82,7 @@ #define MUSBOTG_INTR_ENDPT 1 #define MUSBOTG_BUS2SC(bus) \ - ((struct musbotg_softc *)(((uint8_t *)(bus)) - \ - USB_P2U(&(((struct musbotg_softc *)0)->sc_bus)))) + __containerof(bus, struct musbotg_softc, sc_bus) #define MUSBOTG_PC2SC(pc) \ MUSBOTG_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus) diff --git a/sys/dev/usb/controller/uss820dci.c b/sys/dev/usb/controller/uss820dci.c index b2e112b07f6e..4fc6d5dbfea2 100644 --- a/sys/dev/usb/controller/uss820dci.c +++ b/sys/dev/usb/controller/uss820dci.c @@ -77,8 +77,7 @@ #include #define USS820_DCI_BUS2SC(bus) \ - ((struct uss820dci_softc *)(((uint8_t *)(bus)) - \ - ((uint8_t *)&(((struct uss820dci_softc *)0)->sc_bus)))) + __containerof(bus, struct uss820dci_softc, sc_bus) #define USS820_DCI_PC2SC(pc) \ USS820_DCI_BUS2SC(USB_DMATAG_TO_XROOT((pc)->tag_parent)->bus) diff --git a/sys/dev/usb/controller/xhci.c b/sys/dev/usb/controller/xhci.c index 10e37c97c254..db2aad057bc0 100644 --- a/sys/dev/usb/controller/xhci.c +++ b/sys/dev/usb/controller/xhci.c @@ -336,7 +336,7 @@ xhci_reset_command_queue_locked(struct xhci_softc *sc) /* set up command ring control base address */ addr = buf_res.physaddr; phwr = buf_res.buffer; - addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_commands[0]; + addr += __offsetof(struct xhci_hw_root, hwr_commands[0]); DPRINTF("CRCR=0x%016llx\n", (unsigned long long)addr); @@ -392,7 +392,7 @@ xhci_start_controller(struct xhci_softc *sc) memset(pdctxa, 0, sizeof(*pdctxa)); addr = buf_res.physaddr; - addr += (uintptr_t)&((struct xhci_dev_ctx_addr *)0)->qwSpBufPtr[0]; + addr += __offsetof(struct xhci_dev_ctx_addr, qwSpBufPtr[0]); /* slot 0 points to the table of scratchpad pointers */ pdctxa->qwBaaDevCtxAddr[0] = htole64(addr); @@ -423,7 +423,7 @@ xhci_start_controller(struct xhci_softc *sc) phwr = buf_res.buffer; addr = buf_res.physaddr; - addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_events[0]; + addr += __offsetof(struct xhci_hw_root, hwr_events[0]); /* reset hardware root structure */ memset(phwr, 0, sizeof(*phwr)); @@ -463,7 +463,7 @@ xhci_start_controller(struct xhci_softc *sc) /* set up command ring control base address */ addr = buf_res.physaddr; - addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_commands[0]; + addr += __offsetof(struct xhci_hw_root, hwr_commands[0]); DPRINTF("CRCR=0x%016llx\n", (unsigned long long)addr); @@ -1152,7 +1152,7 @@ xhci_interrupt_poll(struct xhci_softc *sc) */ addr = buf_res.physaddr; - addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_events[i]; + addr += __offsetof(struct xhci_hw_root, hwr_events[i]); /* try to clear busy bit */ addr |= XHCI_ERDP_LO_BUSY; @@ -1216,7 +1216,7 @@ retry: usb_pc_cpu_flush(&sc->sc_hw.root_pc); addr = buf_res.physaddr; - addr += (uintptr_t)&((struct xhci_hw_root *)0)->hwr_commands[i]; + addr += __offsetof(struct xhci_hw_root, hwr_commands[i]); sc->sc_cmd_addr = htole64(addr);