Re: [PATCH 14/22] usb: misc: fix a few spelling mistakes in comments

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] usb: misc: emi26: infinite loop in emi26_load_firmware() [1]
--

commit dcf01fbf19632d3a153a43eecd101490f0323a24
Author: Shunbo Shi <shishunbo@cmss.chinamobile.com>

usb: misc: fix a few spelling mistakes in comments

This commit fixes spelling mistakes in comments in the emi26, emi62, and
ldusb drivers.

> diff --git a/drivers/usb/misc/emi26.c b/drivers/usb/misc/emi26.c
> index 24d841850e056..a0fd800820438 100644
> --- a/drivers/usb/misc/emi26.c
> +++ b/drivers/usb/misc/emi26.c
> @@ -198,7 +198,7 @@ static int emi26_load_firmware (struct usb_device *dev)
>  		goto wraperr;
>  	msleep(250);	/* let device settle */
>  
> -	/* return 1 to fail the driver inialization
> +	/* return 1 to fail the driver initialization
>  	 * and give real driver change to load */
>  	err = 1;
>  
> diff --git a/drivers/usb/misc/emi62.c b/drivers/usb/misc/emi62.c
> index 3eea60437f567..d29b5312f6270 100644
> --- a/drivers/usb/misc/emi62.c
> +++ b/drivers/usb/misc/emi62.c
> @@ -211,7 +211,7 @@ static int emi62_load_firmware (struct usb_device *dev)
>  
>  	kfree(buf);
>  
> -	/* return 1 to fail the driver inialization
> +	/* return 1 to fail the driver initialization
>  	 * and give real driver change to load */
>  	return 1;

[Severity: High]
This problem wasn't introduced by this patch, but can emi26_load_firmware()
and emi62_load_firmware() enter an infinite loop [1] if a bitstream_fw
ihex record has a length of at least FW_LOAD_SIZE (1023)?

drivers/usb/misc/emi26.c:emi26_load_firmware() {
	...
	rec = (const struct ihex_binrec *)bitstream_fw->data;
	do {
		i = 0;
		addr = be32_to_cpu(rec->addr);

		/* intel hex records are terminated with type 0 element */
		while (rec && (i + be16_to_cpu(rec->len) < FW_LOAD_SIZE)) {
			memcpy(buf + i, rec->data, be16_to_cpu(rec->len));
			i += be16_to_cpu(rec->len);
			rec = ihex_next_binrec(rec);
		}
		err = emi26_writememory(dev, addr, buf, i, ANCHOR_LOAD_FPGA);
		if (err < 0)
			goto wraperr;
	} while (rec);
	...
}

When be16_to_cpu(rec->len) >= FW_LOAD_SIZE, the inner while loop does not
execute even with i == 0 and leaves rec unchanged, so the outer do-while
loop repeatedly issues a 0-byte write and spins forever during probe.

[1] https://sashiko.dev/#/bug/linux-c69bd064-7969-4899-86f0-dc199358fd96

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110064105.20335-1-shishunbo@cmss.chinamobile.com?part=14