From: Dan Carpenter <dan.carpenter@linaro.org>
To: "Rangoju, Raju" <raju.rangoju@amd.com>
Cc: broonie@kernel.org, linux-spi@vger.kernel.org,
linux-kernel@vger.kernel.org, miquel.raynal@bootlin.com,
Krishnamoorthi M <krishnamoorthi.m@amd.com>,
Akshata MukundShetty <akshata.mukundshetty@amd.com>,
cve@kernel.org,
Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Subject: Re: [PATCH] spi: spi-mem: Add fix to avoid divide error
Date: Tue, 10 Jun 2025 11:03:50 +0300 [thread overview]
Message-ID: <aEfm5ia_i4DrKnt6@stanley.mountain> (raw)
In-Reply-To: <76916f5d-bf5b-4e4c-9252-d537dc00a2ed@amd.com>
On Mon, Jun 09, 2025 at 04:10:53PM +0530, Rangoju, Raju wrote:
>
>
> On 6/2/2025 3:15 PM, Dan Carpenter wrote:
> > On Thu, Apr 24, 2025 at 05:43:33PM +0530, Raju Rangoju wrote:
> > >
> > > Fixes: 226d6cb3cb79 ("spi: spi-mem: Estimate the time taken by operations")
> > > Suggested-by: Krishnamoorthi M <krishnamoorthi.m@amd.com>
> > > Co-developed-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
> > > Signed-off-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
> > > Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
> > > ---
> > > drivers/spi/spi-mem.c | 6 +++++-
> > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
> > > index a31a1db07aa4..5db0639d3b01 100644
> > > --- a/drivers/spi/spi-mem.c
> > > +++ b/drivers/spi/spi-mem.c
> > > @@ -596,7 +596,11 @@ u64 spi_mem_calc_op_duration(struct spi_mem_op *op)
> > > ns_per_cycles = 1000000000 / op->max_freq;
> > > ncycles += ((op->cmd.nbytes * 8) / op->cmd.buswidth) / (op->cmd.dtr ? 2 : 1);
> > > ncycles += ((op->addr.nbytes * 8) / op->addr.buswidth) / (op->addr.dtr ? 2 : 1);
> > > - ncycles += ((op->dummy.nbytes * 8) / op->dummy.buswidth) / (op->dummy.dtr ? 2 : 1);
> > > +
> > > + /* Dummy bytes are optional for some SPI flash memory operations */
> > > + if (op->dummy.nbytes)
> > > + ncycles += ((op->dummy.nbytes * 8) / op->dummy.buswidth) / (op->dummy.dtr ? 2 : 1);
> > > +
> >
> > Hi,
> >
> > We were reviewing "CVE-2025-37896: spi: spi-mem: Add fix to avoid divide
> > error" which was issued for this patch, but this patch is a no-op.
> >
> > If op->dummy.nbytes is zero then the original code does:
> >
> > ncycles += 0;
> >
> > We don't divide by op->dummy.nbytes. Was something else intended?
>
> Hi,
>
> When there are no dummy bytes for an spi-mem operation, both
> op->dummy.nbytes and op->dummy.buswidth are zero.
>
> This can lead to a divide-by-zero error.
>
Ah. Ok. I didn't realize they were connected that way. Thanks!
regards,
dan carpenter
prev parent reply other threads:[~2025-06-10 8:03 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-24 12:13 [PATCH] spi: spi-mem: Add fix to avoid divide error Raju Rangoju
2025-04-24 12:15 ` Mark Brown
2025-04-24 12:27 ` Rangoju, Raju
2025-04-24 12:44 ` Mark Brown
2025-04-24 14:25 ` Miquel Raynal
2025-04-25 16:03 ` Mark Brown
2025-06-02 9:45 ` Dan Carpenter
2025-06-09 10:40 ` Rangoju, Raju
2025-06-10 8:03 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aEfm5ia_i4DrKnt6@stanley.mountain \
--to=dan.carpenter@linaro.org \
--cc=akshata.mukundshetty@amd.com \
--cc=broonie@kernel.org \
--cc=cve@kernel.org \
--cc=harshit.m.mogalapalli@oracle.com \
--cc=krishnamoorthi.m@amd.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=miquel.raynal@bootlin.com \
--cc=raju.rangoju@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox