2023-03-24 16:23:41

by Jeffrey Hugo

Subject: [PATCH v2] bus: mhi: host: Range check CHDBOFF and ERDBOFF

If the value read from the CHDBOFF and ERDBOFF registers is outside the
range of the MHI register space then an invalid address might be computed
which later causes a kernel panic. Range check the read value to prevent
a crash due to bad data from the device.

Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
Cc: [email protected]
Signed-off-by: Jeffrey Hugo <[email protected]>
Reviewed-by: Pranjal Ramajor Asha Kanojiya <[email protected]>
---

v2:
-CC stable
-Use ERANGE for the error code

drivers/bus/mhi/host/init.c | 12 ++++++++++++
1 file changed, 12 insertions(+)

diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
index 3d779ee..b46a082 100644
--- a/drivers/bus/mhi/host/init.c
+++ b/drivers/bus/mhi/host/init.c
@@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
return -EIO;
}

+ if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) {
+ dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n",
+ val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB));
+ return -ERANGE;
+ }
+
/* Setup wake db */
mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB);
mhi_cntrl->wake_set = false;
@@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
return -EIO;
}

+ if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) {
+ dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n",
+ val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings));
+ return -ERANGE;
+ }
+
/* Setup event db address for each ev_ring */
mhi_event = mhi_cntrl->mhi_event;
for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) {
--
2.7.4

2023-03-27 10:26:36

by Manivannan Sadhasivam

Subject: Re: [PATCH v2] bus: mhi: host: Range check CHDBOFF and ERDBOFF

On Fri, Mar 24, 2023 at 10:13:04AM -0600, Jeffrey Hugo wrote:
> If the value read from the CHDBOFF and ERDBOFF registers is outside the
> range of the MHI register space then an invalid address might be computed
> which later causes a kernel panic. Range check the read value to prevent
> a crash due to bad data from the device.
>
> Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
> Cc: [email protected]
> Signed-off-by: Jeffrey Hugo <[email protected]>

Reviewed-by: Manivannan Sadhasivam <[email protected]>

Thanks,
Mani

> Reviewed-by: Pranjal Ramajor Asha Kanojiya <[email protected]>
> ---
>
> v2:
> -CC stable
> -Use ERANGE for the error code
>
> drivers/bus/mhi/host/init.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
> diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
> index 3d779ee..b46a082 100644
> --- a/drivers/bus/mhi/host/init.c
> +++ b/drivers/bus/mhi/host/init.c
> @@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> return -EIO;
> }
>
> + if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) {
> + dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n",
> + val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB));
> + return -ERANGE;
> + }
> +
> /* Setup wake db */
> mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB);
> mhi_cntrl->wake_set = false;
> @@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> return -EIO;
> }
>
> + if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) {
> + dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n",
> + val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings));
> + return -ERANGE;
> + }
> +
> /* Setup event db address for each ev_ring */
> mhi_event = mhi_cntrl->mhi_event;
> for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) {
> --
> 2.7.4
>
>

--
மணிவண்ணன் சதாசிவம்

2023-04-03 05:19:20

by Manivannan Sadhasivam

Subject: Re: [PATCH v2] bus: mhi: host: Range check CHDBOFF and ERDBOFF

On Fri, Mar 24, 2023 at 10:13:04AM -0600, Jeffrey Hugo wrote:
> If the value read from the CHDBOFF and ERDBOFF registers is outside the
> range of the MHI register space then an invalid address might be computed
> which later causes a kernel panic. Range check the read value to prevent
> a crash due to bad data from the device.
>
> Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
> Cc: [email protected]
> Signed-off-by: Jeffrey Hugo <[email protected]>

Applied to mhi-next!

- Mani

> Reviewed-by: Pranjal Ramajor Asha Kanojiya <[email protected]>
> ---
>
> v2:
> -CC stable
> -Use ERANGE for the error code
>
> drivers/bus/mhi/host/init.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
> diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
> index 3d779ee..b46a082 100644
> --- a/drivers/bus/mhi/host/init.c
> +++ b/drivers/bus/mhi/host/init.c
> @@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> return -EIO;
> }
>
> + if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) {
> + dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n",
> + val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB));
> + return -ERANGE;
> + }
> +
> /* Setup wake db */
> mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB);
> mhi_cntrl->wake_set = false;
> @@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl)
> return -EIO;
> }
>
> + if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) {
> + dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n",
> + val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings));
> + return -ERANGE;
> + }
> +
> /* Setup event db address for each ev_ring */
> mhi_event = mhi_cntrl->mhi_event;
> for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) {
> --
> 2.7.4
>

--
மணிவண்ணன் சதாசிவம்