lkml.org 
[lkml]   [2021]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/8] bus: mhi: core: Validate channel ID when processing command completions
    Date
    From: Bhaumik Bhatt <bbhatt@codeaurora.org>

    MHI reads the channel ID from the event ring element sent by the
    device which can be any value between 0 and 255. In order to
    prevent any out of bound accesses, add a check against the maximum
    number of channels supported by the controller and those channels
    not configured yet so as to skip processing of that event ring
    element.

    Cc: stable@vger.kernel.org
    Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device")
    Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
    Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
    Link: https://lore.kernel.org/r/1619481538-4435-1-git-send-email-bbhatt@codeaurora.org
    Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    ---
    drivers/bus/mhi/core/main.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c
    index 22acde118bc3..ed07421c4870 100644
    --- a/drivers/bus/mhi/core/main.c
    +++ b/drivers/bus/mhi/core/main.c
    @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl,
    cmd_pkt = mhi_to_virtual(mhi_ring, ptr);

    chan = MHI_TRE_GET_CMD_CHID(cmd_pkt);
    - mhi_chan = &mhi_cntrl->mhi_chan[chan];
    - write_lock_bh(&mhi_chan->lock);
    - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre);
    - complete(&mhi_chan->completion);
    - write_unlock_bh(&mhi_chan->lock);
    + WARN_ON(chan >= mhi_cntrl->max_chan);
    +
    + if (chan < mhi_cntrl->max_chan &&
    + mhi_cntrl->mhi_chan[chan].configured) {
    + mhi_chan = &mhi_cntrl->mhi_chan[chan];
    + write_lock_bh(&mhi_chan->lock);
    + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre);
    + complete(&mhi_chan->completion);
    + write_unlock_bh(&mhi_chan->lock);
    + }

    mhi_del_ring_element(mhi_cntrl, mhi_ring);
    }
    --
    2.25.1
    \
     
     \ /
      Last update: 2021-06-21 18:17    [W:4.093 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site