[PATCH v2 0/3] A trio of vchiq bulk transfer fixes

[PATCH v2 0/3] A trio of vchiq bulk transfer fixes

[Phil Elwell]

The recent batch of vchiq improvements broke bulk transfers in two ways:

1. The userdata associated with a transfer was lost in the case that a
   non-blocking mode was used.

2. The 64-bit ioctl compatibility shim for a bulk transfer used the
   wrong ioctl command.

This patch set fixes both of those bugs, and adds a security-related
note to the TODO file.

Changes in v2:
- Expand the commit message on patch 1 to clarify the impact of the
  bug, and add Tested-by.
- Add commit 3 with an additional TODO item.
- Change the name of the patch set to be numerically accurate.

Phil Elwell (3):
  staging: vchiq: Fix bulk userdata handling
  staging: vchiq: Fix bulk transfers on 64-bit builds
  staging: vc04_services: Add a note to the TODO

 drivers/staging/vc04_services/interface/TODO                | 4 ++++
 .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c   | 6 ++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

-- 
2.25.1

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v2 0/3] A trio of vchiq bulk transfer fixes

[Phil Elwell]

The recent batch of vchiq improvements broke bulk transfers in two ways:

1. The userdata associated with a transfer was lost in the case that a
   non-blocking mode was used.

2. The 64-bit ioctl compatibility shim for a bulk transfer used the
   wrong ioctl command.

This patch set fixes both of those bugs, and adds a security-related
note to the TODO file.

Changes in v2:
- Expand the commit message on patch 1 to clarify the impact of the
  bug, and add Tested-by.
- Add commit 3 with an additional TODO item.
- Change the name of the patch set to be numerically accurate.

Phil Elwell (3):
  staging: vchiq: Fix bulk userdata handling
  staging: vchiq: Fix bulk transfers on 64-bit builds
  staging: vc04_services: Add a note to the TODO

 drivers/staging/vc04_services/interface/TODO                | 4 ++++
 .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c   | 6 ++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

-- 
2.25.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v2 1/3] staging: vchiq: Fix bulk userdata handling

[Phil Elwell]

The addition of the local 'userdata' pointer to
vchiq_irq_queue_bulk_tx_rx omitted the case where neither BLOCKING nor
WAITING modes are used, in which case the value provided by the
caller is not returned to them as expected, but instead it is replaced
with a NULL. This lack of a suitable context may cause the application
to crash or otherwise malfunction.

Fixes: 4184da4f316a ("staging: vchiq: fix __user annotations")

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index f500a7043805..2a8883673ba1 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -958,7 +958,7 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
 	struct vchiq_service *service;
 	struct bulk_waiter_node *waiter = NULL;
 	bool found = false;
-	void *userdata = NULL;
+	void *userdata;
 	int status = 0;
 	int ret;
 
@@ -997,6 +997,8 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
 			"found bulk_waiter %pK for pid %d", waiter,
 			current->pid);
 		userdata = &waiter->bulk_waiter;
+	} else {
+		userdata = args->userdata;
 	}
 
 	/*
-- 
2.25.1

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v2 1/3] staging: vchiq: Fix bulk userdata handling

[Phil Elwell]

The addition of the local 'userdata' pointer to
vchiq_irq_queue_bulk_tx_rx omitted the case where neither BLOCKING nor
WAITING modes are used, in which case the value provided by the
caller is not returned to them as expected, but instead it is replaced
with a NULL. This lack of a suitable context may cause the application
to crash or otherwise malfunction.

Fixes: 4184da4f316a ("staging: vchiq: fix __user annotations")

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index f500a7043805..2a8883673ba1 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -958,7 +958,7 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
 	struct vchiq_service *service;
 	struct bulk_waiter_node *waiter = NULL;
 	bool found = false;
-	void *userdata = NULL;
+	void *userdata;
 	int status = 0;
 	int ret;
 
@@ -997,6 +997,8 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
 			"found bulk_waiter %pK for pid %d", waiter,
 			current->pid);
 		userdata = &waiter->bulk_waiter;
+	} else {
+		userdata = args->userdata;
 	}
 
 	/*
-- 
2.25.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v2 2/3] staging: vchiq: Fix bulk transfers on 64-bit builds

[Phil Elwell]

The recent change to the bulk transfer compat function missed the fact
the relevant ioctl command is VCHIQ_IOC_QUEUE_BULK_TRANSMIT32, not
VCHIQ_IOC_QUEUE_BULK_TRANSMIT, as any attempt to send a bulk block
to the VPU would have shown.

Fixes: a4367cd2b231 ("staging: vchiq: convert compat bulk transfer")

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 2a8883673ba1..2ca5805b2fce 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1717,7 +1717,7 @@ vchiq_compat_ioctl_queue_bulk(struct file *file,
 {
 	struct vchiq_queue_bulk_transfer32 args32;
 	struct vchiq_queue_bulk_transfer args;
-	enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT) ?
+	enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT32) ?
 				  VCHIQ_BULK_TRANSMIT : VCHIQ_BULK_RECEIVE;
 
 	if (copy_from_user(&args32, argp, sizeof(args32)))
-- 
2.25.1

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v2 2/3] staging: vchiq: Fix bulk transfers on 64-bit builds

[Phil Elwell]

The recent change to the bulk transfer compat function missed the fact
the relevant ioctl command is VCHIQ_IOC_QUEUE_BULK_TRANSMIT32, not
VCHIQ_IOC_QUEUE_BULK_TRANSMIT, as any attempt to send a bulk block
to the VPU would have shown.

Fixes: a4367cd2b231 ("staging: vchiq: convert compat bulk transfer")

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 2a8883673ba1..2ca5805b2fce 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1717,7 +1717,7 @@ vchiq_compat_ioctl_queue_bulk(struct file *file,
 {
 	struct vchiq_queue_bulk_transfer32 args32;
 	struct vchiq_queue_bulk_transfer args;
-	enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT) ?
+	enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT32) ?
 				  VCHIQ_BULK_TRANSMIT : VCHIQ_BULK_RECEIVE;
 
 	if (copy_from_user(&args32, argp, sizeof(args32)))
-- 
2.25.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v2 3/3] staging: vc04_services: Add a note to the TODO

[Phil Elwell]

Record in the TODO file that the address of "&waiter->bulk_waiter"
should never be returned to userspace.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
---
 drivers/staging/vc04_services/interface/TODO | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/vc04_services/interface/TODO b/drivers/staging/vc04_services/interface/TODO
index fc2752bc95b2..0bcb8f158afc 100644
--- a/drivers/staging/vc04_services/interface/TODO
+++ b/drivers/staging/vc04_services/interface/TODO
@@ -91,3 +91,7 @@ The first thing one generally sees in a probe function is a memory allocation
 for all the device specific data. This structure is then passed all over the
 driver. This is good practice since it makes the driver work regardless of the
 number of devices probed.
+
+14) Clean up Sparse warnings from __user annotations. See
+vchiq_irq_queue_bulk_tx_rx(). Ensure that the address of "&waiter->bulk_waiter"
+is never disclosed to userspace.
-- 
2.25.1

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v2 3/3] staging: vc04_services: Add a note to the TODO

[Phil Elwell]

Record in the TODO file that the address of "&waiter->bulk_waiter"
should never be returned to userspace.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
---
 drivers/staging/vc04_services/interface/TODO | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/vc04_services/interface/TODO b/drivers/staging/vc04_services/interface/TODO
index fc2752bc95b2..0bcb8f158afc 100644
--- a/drivers/staging/vc04_services/interface/TODO
+++ b/drivers/staging/vc04_services/interface/TODO
@@ -91,3 +91,7 @@ The first thing one generally sees in a probe function is a memory allocation
 for all the device specific data. This structure is then passed all over the
 driver. This is good practice since it makes the driver work regardless of the
 number of devices probed.
+
+14) Clean up Sparse warnings from __user annotations. See
+vchiq_irq_queue_bulk_tx_rx(). Ensure that the address of "&waiter->bulk_waiter"
+is never disclosed to userspace.
-- 
2.25.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH v2 0/3] A trio of vchiq bulk transfer fixes

[Dan Carpenter]

Thanks!

Acked-by: Dan Carpenter <dan.carpenter@oracle.com>

regards,
dan carpenter

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: [PATCH v2 0/3] A trio of vchiq bulk transfer fixes

[Dan Carpenter]

Thanks!

Acked-by: Dan Carpenter <dan.carpenter@oracle.com>

regards,
dan carpenter


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH v2 2/3] staging: vchiq: Fix bulk transfers on 64-bit builds

[Arnd Bergmann]

On Tue, Jan 5, 2021 at 5:20 PM Phil Elwell <phil@raspberrypi.com> wrote:
>
> The recent change to the bulk transfer compat function missed the fact
> the relevant ioctl command is VCHIQ_IOC_QUEUE_BULK_TRANSMIT32, not
> VCHIQ_IOC_QUEUE_BULK_TRANSMIT, as any attempt to send a bulk block
> to the VPU would have shown.
>
> Fixes: a4367cd2b231 ("staging: vchiq: convert compat bulk transfer")
>
> Signed-off-by: Phil Elwell <phil@raspberrypi.com>

Acked-by: Arnd Bergmann <arnd@arndb.de>
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: [PATCH v2 2/3] staging: vchiq: Fix bulk transfers on 64-bit builds

[Arnd Bergmann]

On Tue, Jan 5, 2021 at 5:20 PM Phil Elwell <phil@raspberrypi.com> wrote:
>
> The recent change to the bulk transfer compat function missed the fact
> the relevant ioctl command is VCHIQ_IOC_QUEUE_BULK_TRANSMIT32, not
> VCHIQ_IOC_QUEUE_BULK_TRANSMIT, as any attempt to send a bulk block
> to the VPU would have shown.
>
> Fixes: a4367cd2b231 ("staging: vchiq: convert compat bulk transfer")
>
> Signed-off-by: Phil Elwell <phil@raspberrypi.com>

Acked-by: Arnd Bergmann <arnd@arndb.de>

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH v2 0/3] A trio of vchiq bulk transfer fixes

[Nicolas Saenz Julienne]

[-- Attachment #1.1: Type: text/plain, Size: 1177 bytes --]

On Tue, 2021-01-05 at 16:20 +0000, Phil Elwell wrote:
> The recent batch of vchiq improvements broke bulk transfers in two ways:
> 
> 1. The userdata associated with a transfer was lost in the case that a
>    non-blocking mode was used.
> 
> 2. The 64-bit ioctl compatibility shim for a bulk transfer used the
>    wrong ioctl command.
> 
> This patch set fixes both of those bugs, and adds a security-related
> note to the TODO file.
> 
> Changes in v2:
> - Expand the commit message on patch 1 to clarify the impact of the
>   bug, and add Tested-by.
> - Add commit 3 with an additional TODO item.
> - Change the name of the patch set to be numerically accurate.
> 
> Phil Elwell (3):
>   staging: vchiq: Fix bulk userdata handling
>   staging: vchiq: Fix bulk transfers on 64-bit builds
>   staging: vc04_services: Add a note to the TODO
> 
>  drivers/staging/vc04_services/interface/TODO                | 4 ++++
>  .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c   | 6 ++++--
>  2 files changed, 8 insertions(+), 2 deletions(-)
> 

Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>

Regards,
Nicolas


[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 169 bytes --]

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: [PATCH v2 0/3] A trio of vchiq bulk transfer fixes

[Nicolas Saenz Julienne]

[-- Attachment #1.1: Type: text/plain, Size: 1177 bytes --]

On Tue, 2021-01-05 at 16:20 +0000, Phil Elwell wrote:
> The recent batch of vchiq improvements broke bulk transfers in two ways:
> 
> 1. The userdata associated with a transfer was lost in the case that a
>    non-blocking mode was used.
> 
> 2. The 64-bit ioctl compatibility shim for a bulk transfer used the
>    wrong ioctl command.
> 
> This patch set fixes both of those bugs, and adds a security-related
> note to the TODO file.
> 
> Changes in v2:
> - Expand the commit message on patch 1 to clarify the impact of the
>   bug, and add Tested-by.
> - Add commit 3 with an additional TODO item.
> - Change the name of the patch set to be numerically accurate.
> 
> Phil Elwell (3):
>   staging: vchiq: Fix bulk userdata handling
>   staging: vchiq: Fix bulk transfers on 64-bit builds
>   staging: vc04_services: Add a note to the TODO
> 
>  drivers/staging/vc04_services/interface/TODO                | 4 ++++
>  .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c   | 6 ++++--
>  2 files changed, 8 insertions(+), 2 deletions(-)
> 

Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>

Regards,
Nicolas


[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 176 bytes --]

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel