MHI reads the channel ID from the event ring element sent by the device which can be any value between 0 and 255. In order to prevent any out of bound accesses, add a check against the maximum number of channels supported by the controller and those channels not configured yet so as to skip processing of that event ring element. Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> --- drivers/bus/mhi/core/main.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c index 22acde1..ed07421 100644 --- a/drivers/bus/mhi/core/main.c +++ b/drivers/bus/mhi/core/main.c @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, cmd_pkt = mhi_to_virtual(mhi_ring, ptr); chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); - mhi_chan = &mhi_cntrl->mhi_chan[chan]; - write_lock_bh(&mhi_chan->lock); - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); - complete(&mhi_chan->completion); - write_unlock_bh(&mhi_chan->lock); + WARN_ON(chan >= mhi_cntrl->max_chan); + + if (chan < mhi_cntrl->max_chan && + mhi_cntrl->mhi_chan[chan].configured) { + mhi_chan = &mhi_cntrl->mhi_chan[chan]; + write_lock_bh(&mhi_chan->lock); + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); + complete(&mhi_chan->completion); + write_unlock_bh(&mhi_chan->lock); + } mhi_del_ring_element(mhi_cntrl, mhi_ring); } -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
On 4/26/21 4:58 PM, Bhaumik Bhatt wrote:
> MHI reads the channel ID from the event ring element sent by the
> device which can be any value between 0 and 255. In order to
> prevent any out of bound accesses, add a check against the maximum
> number of channels supported by the controller and those channels
> not configured yet so as to skip processing of that event ring
> element.
>
> Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device")
> Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
> ---
Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
--
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
On 4/26/2021 5:58 PM, Bhaumik Bhatt wrote:
> MHI reads the channel ID from the event ring element sent by the
> device which can be any value between 0 and 255. In order to
> prevent any out of bound accesses, add a check against the maximum
> number of channels supported by the controller and those channels
> not configured yet so as to skip processing of that event ring
> element.
>
> Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device")
> Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
> ---
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
On Mon, Apr 26, 2021 at 04:58:58PM -0700, Bhaumik Bhatt wrote: > MHI reads the channel ID from the event ring element sent by the > device which can be any value between 0 and 255. In order to > prevent any out of bound accesses, add a check against the maximum > number of channels supported by the controller and those channels > not configured yet so as to skip processing of that event ring > element. > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Thanks, Mani > --- > drivers/bus/mhi/core/main.c | 15 ++++++++++----- > 1 file changed, 10 insertions(+), 5 deletions(-) > > diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c > index 22acde1..ed07421 100644 > --- a/drivers/bus/mhi/core/main.c > +++ b/drivers/bus/mhi/core/main.c > @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, > cmd_pkt = mhi_to_virtual(mhi_ring, ptr); > > chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); > - mhi_chan = &mhi_cntrl->mhi_chan[chan]; > - write_lock_bh(&mhi_chan->lock); > - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > - complete(&mhi_chan->completion); > - write_unlock_bh(&mhi_chan->lock); > + WARN_ON(chan >= mhi_cntrl->max_chan); > + > + if (chan < mhi_cntrl->max_chan && > + mhi_cntrl->mhi_chan[chan].configured) { > + mhi_chan = &mhi_cntrl->mhi_chan[chan]; > + write_lock_bh(&mhi_chan->lock); > + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > + complete(&mhi_chan->completion); > + write_unlock_bh(&mhi_chan->lock); > + } > > mhi_del_ring_element(mhi_cntrl, mhi_ring); > } > -- > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > a Linux Foundation Collaborative Project >
On Mon, Apr 26, 2021 at 04:58:58PM -0700, Bhaumik Bhatt wrote: > MHI reads the channel ID from the event ring element sent by the > device which can be any value between 0 and 255. In order to > prevent any out of bound accesses, add a check against the maximum > number of channels supported by the controller and those channels > not configured yet so as to skip processing of that event ring > element. > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> Applied to mhi-next! Thanks, Mani > --- > drivers/bus/mhi/core/main.c | 15 ++++++++++----- > 1 file changed, 10 insertions(+), 5 deletions(-) > > diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c > index 22acde1..ed07421 100644 > --- a/drivers/bus/mhi/core/main.c > +++ b/drivers/bus/mhi/core/main.c > @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, > cmd_pkt = mhi_to_virtual(mhi_ring, ptr); > > chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); > - mhi_chan = &mhi_cntrl->mhi_chan[chan]; > - write_lock_bh(&mhi_chan->lock); > - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > - complete(&mhi_chan->completion); > - write_unlock_bh(&mhi_chan->lock); > + WARN_ON(chan >= mhi_cntrl->max_chan); > + > + if (chan < mhi_cntrl->max_chan && > + mhi_cntrl->mhi_chan[chan].configured) { > + mhi_chan = &mhi_cntrl->mhi_chan[chan]; > + write_lock_bh(&mhi_chan->lock); > + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > + complete(&mhi_chan->completion); > + write_unlock_bh(&mhi_chan->lock); > + } > > mhi_del_ring_element(mhi_cntrl, mhi_ring); > } > -- > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > a Linux Foundation Collaborative Project >
On Mon, May 24, 2021 at 10:12:28AM +0530, Manivannan Sadhasivam wrote: > On Mon, Apr 26, 2021 at 04:58:58PM -0700, Bhaumik Bhatt wrote: > > MHI reads the channel ID from the event ring element sent by the > > device which can be any value between 0 and 255. In order to > > prevent any out of bound accesses, add a check against the maximum > > number of channels supported by the controller and those channels > > not configured yet so as to skip processing of that event ring > > element. > > > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> > > Applied to mhi-next! > Sorry this has been applied to mhi-next! Thanks, Mani > Thanks, > Mani > > > --- > > drivers/bus/mhi/core/main.c | 15 ++++++++++----- > > 1 file changed, 10 insertions(+), 5 deletions(-) > > > > diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c > > index 22acde1..ed07421 100644 > > --- a/drivers/bus/mhi/core/main.c > > +++ b/drivers/bus/mhi/core/main.c > > @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, > > cmd_pkt = mhi_to_virtual(mhi_ring, ptr); > > > > chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); > > - mhi_chan = &mhi_cntrl->mhi_chan[chan]; > > - write_lock_bh(&mhi_chan->lock); > > - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > > - complete(&mhi_chan->completion); > > - write_unlock_bh(&mhi_chan->lock); > > + WARN_ON(chan >= mhi_cntrl->max_chan); > > + > > + if (chan < mhi_cntrl->max_chan && > > + mhi_cntrl->mhi_chan[chan].configured) { > > + mhi_chan = &mhi_cntrl->mhi_chan[chan]; > > + write_lock_bh(&mhi_chan->lock); > > + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > > + complete(&mhi_chan->completion); > > + write_unlock_bh(&mhi_chan->lock); > > + } > > > > mhi_del_ring_element(mhi_cntrl, mhi_ring); > > } > > -- > > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > > a Linux Foundation Collaborative Project > >
MHI reads the channel ID from the event ring element sent by the device which can be any value between 0 and 255. In order to prevent any out of bound accesses, add a check against the maximum number of channels supported by the controller and those channels not configured yet so as to skip processing of that event ring element. Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> Reviewed-by: Hemant Kumar <hemantk@codeaurora.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Link: https://lore.kernel.org/r/1619481538-4435-1-git-send-email-bbhatt@codeaurora.org --- drivers/bus/mhi/core/main.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c index 22acde1..fc9196f 100644 --- a/drivers/bus/mhi/core/main.c +++ b/drivers/bus/mhi/core/main.c @@ -773,11 +773,18 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, cmd_pkt = mhi_to_virtual(mhi_ring, ptr); chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); - mhi_chan = &mhi_cntrl->mhi_chan[chan]; - write_lock_bh(&mhi_chan->lock); - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); - complete(&mhi_chan->completion); - write_unlock_bh(&mhi_chan->lock); + + if (chan < mhi_cntrl->max_chan && + mhi_cntrl->mhi_chan[chan].configured) { + mhi_chan = &mhi_cntrl->mhi_chan[chan]; + write_lock_bh(&mhi_chan->lock); + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); + complete(&mhi_chan->completion); + write_unlock_bh(&mhi_chan->lock); + } else { + dev_err(&mhi_cntrl->mhi_dev->dev, + "Completion packet for invalid channel ID: %d\n", chan); + } mhi_del_ring_element(mhi_cntrl, mhi_ring); } -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
On Thu, Jun 24, 2021 at 11:09:01AM -0700, Bhaumik Bhatt wrote: > MHI reads the channel ID from the event ring element sent by the > device which can be any value between 0 and 255. In order to > prevent any out of bound accesses, add a check against the maximum > number of channels supported by the controller and those channels > not configured yet so as to skip processing of that event ring > element. > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> > Reviewed-by: Hemant Kumar <hemantk@codeaurora.org> > Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> > Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> > Link: https://lore.kernel.org/r/1619481538-4435-1-git-send-email-bbhatt@codeaurora.org Removed "Link" and applied to mhi-next! Thanks, Mani > --- > drivers/bus/mhi/core/main.c | 17 ++++++++++++----- > 1 file changed, 12 insertions(+), 5 deletions(-) > > diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c > index 22acde1..fc9196f 100644 > --- a/drivers/bus/mhi/core/main.c > +++ b/drivers/bus/mhi/core/main.c > @@ -773,11 +773,18 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, > cmd_pkt = mhi_to_virtual(mhi_ring, ptr); > > chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); > - mhi_chan = &mhi_cntrl->mhi_chan[chan]; > - write_lock_bh(&mhi_chan->lock); > - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > - complete(&mhi_chan->completion); > - write_unlock_bh(&mhi_chan->lock); > + > + if (chan < mhi_cntrl->max_chan && > + mhi_cntrl->mhi_chan[chan].configured) { > + mhi_chan = &mhi_cntrl->mhi_chan[chan]; > + write_lock_bh(&mhi_chan->lock); > + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > + complete(&mhi_chan->completion); > + write_unlock_bh(&mhi_chan->lock); > + } else { > + dev_err(&mhi_cntrl->mhi_dev->dev, > + "Completion packet for invalid channel ID: %d\n", chan); > + } > > mhi_del_ring_element(mhi_cntrl, mhi_ring); > } > -- > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > a Linux Foundation Collaborative Project >