2023-03-17 15:15:19

by Jeffrey Hugo

[permalink] [raw]
Subject: [PATCH] bus: mhi: host: Range check CHDBOFF and ERDBOFF

If the value read from the CHDBOFF and ERDBOFF registers is outside the
range of the MHI register space then an invalid address might be computed
which later causes a kernel panic. Range check the read value to prevent
a crash due to bad data from the device.

Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
Signed-off-by: Jeffrey Hugo <[email protected]>
Reviewed-by: Pranjal Ramajor Asha Kanojiya <[email protected]>
---
drivers/bus/mhi/host/init.c | 12 ++++++++++++
1 file changed, 12 insertions(+)

diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
index 3d779ee..ae8ebcfb 100644
--- a/drivers/bus/mhi/host/init.c
+++ b/drivers/bus/mhi/host/init.c
@@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
return -EIO;
}

+ if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) {
+ dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n",
+ val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB));
+ return -EINVAL;
+ }
+
/* Setup wake db */
mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB);
mhi_cntrl->wake_set = false;
@@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
return -EIO;
}

+ if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) {
+ dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n",
+ val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings));
+ return -EINVAL;
+ }
+
/* Setup event db address for each ev_ring */
mhi_event = mhi_cntrl->mhi_event;
for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) {
--
2.7.4



2023-03-24 10:36:37

by Manivannan Sadhasivam

[permalink] [raw]
Subject: Re: [PATCH] bus: mhi: host: Range check CHDBOFF and ERDBOFF

On Fri, Mar 17, 2023 at 09:14:19AM -0600, Jeffrey Hugo wrote:
> If the value read from the CHDBOFF and ERDBOFF registers is outside the
> range of the MHI register space then an invalid address might be computed
> which later causes a kernel panic. Range check the read value to prevent
> a crash due to bad data from the device.
>
> Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")

Please CC stable list.

> Signed-off-by: Jeffrey Hugo <[email protected]>
> Reviewed-by: Pranjal Ramajor Asha Kanojiya <[email protected]>
> ---
> drivers/bus/mhi/host/init.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
> diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
> index 3d779ee..ae8ebcfb 100644
> --- a/drivers/bus/mhi/host/init.c
> +++ b/drivers/bus/mhi/host/init.c
> @@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> return -EIO;
> }
>
> + if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) {
> + dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n",
> + val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB));
> + return -EINVAL;

Isn't -ERANGE a better errno here and also in other places of the driver?

Thanks,
Mani

> + }
> +
> /* Setup wake db */
> mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB);
> mhi_cntrl->wake_set = false;
> @@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> return -EIO;
> }
>
> + if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) {
> + dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n",
> + val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings));
> + return -EINVAL;
> + }
> +
> /* Setup event db address for each ev_ring */
> mhi_event = mhi_cntrl->mhi_event;
> for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) {
> --
> 2.7.4
>
>

--
மணிவண்ணன் சதாசிவம்

2023-03-24 13:52:32

by Jeffrey Hugo

[permalink] [raw]
Subject: Re: [PATCH] bus: mhi: host: Range check CHDBOFF and ERDBOFF

On 3/24/2023 4:34 AM, Manivannan Sadhasivam wrote:
> On Fri, Mar 17, 2023 at 09:14:19AM -0600, Jeffrey Hugo wrote:
>> If the value read from the CHDBOFF and ERDBOFF registers is outside the
>> range of the MHI register space then an invalid address might be computed
>> which later causes a kernel panic. Range check the read value to prevent
>> a crash due to bad data from the device.
>>
>> Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
>
> Please CC stable list.

The stable folks have been automatically picking up everything with a
fixes tag for years. CCing the stable list does not seem to do anything
unless the patch needs specific backporting adjustments.

Do you still want an explicit CC?

>
>> Signed-off-by: Jeffrey Hugo <[email protected]>
>> Reviewed-by: Pranjal Ramajor Asha Kanojiya <[email protected]>
>> ---
>> drivers/bus/mhi/host/init.c | 12 ++++++++++++
>> 1 file changed, 12 insertions(+)
>>
>> diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
>> index 3d779ee..ae8ebcfb 100644
>> --- a/drivers/bus/mhi/host/init.c
>> +++ b/drivers/bus/mhi/host/init.c
>> @@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
>> return -EIO;
>> }
>>
>> + if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) {
>> + dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n",
>> + val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB));
>> + return -EINVAL;
>
> Isn't -ERANGE a better errno here and also in other places of the driver?

I suppose that could work. This was modeled after the existing BHI (eg
BHIOFF) range checks. You want those updated in the same change or a
separate one?

> Thanks,
> Mani
>
>> + }
>> +
>> /* Setup wake db */
>> mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB);
>> mhi_cntrl->wake_set = false;
>> @@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
>> return -EIO;
>> }
>>
>> + if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) {
>> + dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n",
>> + val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings));
>> + return -EINVAL;
>> + }
>> +
>> /* Setup event db address for each ev_ring */
>> mhi_event = mhi_cntrl->mhi_event;
>> for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) {
>> --
>> 2.7.4
>>
>>
>

2023-03-24 14:24:27

by Manivannan Sadhasivam

[permalink] [raw]
Subject: Re: [PATCH] bus: mhi: host: Range check CHDBOFF and ERDBOFF

On Fri, Mar 24, 2023 at 07:50:01AM -0600, Jeffrey Hugo wrote:
> On 3/24/2023 4:34 AM, Manivannan Sadhasivam wrote:
> > On Fri, Mar 17, 2023 at 09:14:19AM -0600, Jeffrey Hugo wrote:
> > > If the value read from the CHDBOFF and ERDBOFF registers is outside the
> > > range of the MHI register space then an invalid address might be computed
> > > which later causes a kernel panic. Range check the read value to prevent
> > > a crash due to bad data from the device.
> > >
> > > Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
> >
> > Please CC stable list.
>
> The stable folks have been automatically picking up everything with a fixes
> tag for years. CCing the stable list does not seem to do anything unless
> the patch needs specific backporting adjustments.
>
> Do you still want an explicit CC?
>

That was the impression I had but Greg wanted us to explicitly CC stable list
and add a hint about how deep the patch needs to be applied.

> >
> > > Signed-off-by: Jeffrey Hugo <[email protected]>
> > > Reviewed-by: Pranjal Ramajor Asha Kanojiya <[email protected]>
> > > ---
> > > drivers/bus/mhi/host/init.c | 12 ++++++++++++
> > > 1 file changed, 12 insertions(+)
> > >
> > > diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
> > > index 3d779ee..ae8ebcfb 100644
> > > --- a/drivers/bus/mhi/host/init.c
> > > +++ b/drivers/bus/mhi/host/init.c
> > > @@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> > > return -EIO;
> > > }
> > > + if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) {
> > > + dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n",
> > > + val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB));
> > > + return -EINVAL;
> >
> > Isn't -ERANGE a better errno here and also in other places of the driver?
>
> I suppose that could work. This was modeled after the existing BHI (eg
> BHIOFF) range checks. You want those updated in the same change or a
> separate one?
>

That can go into a separate change.

Thanks,
Mani

> > Thanks,
> > Mani
> >
> > > + }
> > > +
> > > /* Setup wake db */
> > > mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB);
> > > mhi_cntrl->wake_set = false;
> > > @@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> > > return -EIO;
> > > }
> > > + if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) {
> > > + dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n",
> > > + val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings));
> > > + return -EINVAL;
> > > + }
> > > +
> > > /* Setup event db address for each ev_ring */
> > > mhi_event = mhi_cntrl->mhi_event;
> > > for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) {
> > > --
> > > 2.7.4
> > >
> > >
> >
>

--
மணிவண்ணன் சதாசிவம்