* [RESEND PATCH] i2c: s3c2410: fix possible NULL pointer deref on read message after write
@ 2021-05-26 12:39 Krzysztof Kozlowski
2021-05-28 8:17 ` Wolfram Sang
0 siblings, 1 reply; 2+ messages in thread
From: Krzysztof Kozlowski @ 2021-05-26 12:39 UTC (permalink / raw)
To: Krzysztof Kozlowski, linux-i2c, linux-arm-kernel,
linux-samsung-soc, linux-kernel
Cc: Marek Szyprowski, Sylwester Nawrocki, Bartlomiej Zolnierkiewicz,
Tomasz Figa
Interrupt handler processes multiple message write requests one after
another, till the driver message queue is drained. However if driver
encounters a read message without preceding START, it stops the I2C
transfer as it is an invalid condition for the controller. At least the
comment describes a requirement "the controller forces us to send a new
START when we change direction". This stop results in clearing the
message queue (i2c->msg = NULL).
The code however immediately jumped back to label "retry_write" which
dereferenced the "i2c->msg" making it a possible NULL pointer
dereference.
The Coverity analysis:
1. Condition !is_msgend(i2c), taking false branch.
if (!is_msgend(i2c)) {
2. Condition !is_lastmsg(i2c), taking true branch.
} else if (!is_lastmsg(i2c)) {
3. Condition i2c->msg->flags & 1, taking true branch.
if (i2c->msg->flags & I2C_M_RD) {
4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL.
s3c24xx_i2c_stop(i2c, -EINVAL);
5. Jumping to label retry_write.
goto retry_write;
6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg.
if (!is_msgend(i2c)) {"
All previous calls to s3c24xx_i2c_stop() in this interrupt service
routine are followed by jumping to end of function (acknowledging
the interrupt and returning). This seems a reasonable choice also here
since message buffer was entirely emptied.
Addresses-Coverity: Explicit null dereferenced
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
---
Reason for resend - the patch did not get necessary testing however I
think it is correct, therefore resending without "RFT".
---
drivers/i2c/busses/i2c-s3c2410.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index ab928613afba..4d82761e1585 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -480,7 +480,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat)
* forces us to send a new START
* when we change direction
*/
+ dev_dbg(i2c->dev,
+ "missing START before write->read\n");
s3c24xx_i2c_stop(i2c, -EINVAL);
+ break;
}
goto retry_write;
--
2.27.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [RESEND PATCH] i2c: s3c2410: fix possible NULL pointer deref on read message after write
2021-05-26 12:39 [RESEND PATCH] i2c: s3c2410: fix possible NULL pointer deref on read message after write Krzysztof Kozlowski
@ 2021-05-28 8:17 ` Wolfram Sang
0 siblings, 0 replies; 2+ messages in thread
From: Wolfram Sang @ 2021-05-28 8:17 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: linux-i2c, linux-arm-kernel, linux-samsung-soc, linux-kernel,
Marek Szyprowski, Sylwester Nawrocki, Bartlomiej Zolnierkiewicz,
Tomasz Figa
[-- Attachment #1: Type: text/plain, Size: 1798 bytes --]
On Wed, May 26, 2021 at 08:39:37AM -0400, Krzysztof Kozlowski wrote:
> Interrupt handler processes multiple message write requests one after
> another, till the driver message queue is drained. However if driver
> encounters a read message without preceding START, it stops the I2C
> transfer as it is an invalid condition for the controller. At least the
> comment describes a requirement "the controller forces us to send a new
> START when we change direction". This stop results in clearing the
> message queue (i2c->msg = NULL).
>
> The code however immediately jumped back to label "retry_write" which
> dereferenced the "i2c->msg" making it a possible NULL pointer
> dereference.
>
> The Coverity analysis:
> 1. Condition !is_msgend(i2c), taking false branch.
> if (!is_msgend(i2c)) {
>
> 2. Condition !is_lastmsg(i2c), taking true branch.
> } else if (!is_lastmsg(i2c)) {
>
> 3. Condition i2c->msg->flags & 1, taking true branch.
> if (i2c->msg->flags & I2C_M_RD) {
>
> 4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL.
> s3c24xx_i2c_stop(i2c, -EINVAL);
>
> 5. Jumping to label retry_write.
> goto retry_write;
>
> 6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg.
> if (!is_msgend(i2c)) {"
>
> All previous calls to s3c24xx_i2c_stop() in this interrupt service
> routine are followed by jumping to end of function (acknowledging
> the interrupt and returning). This seems a reasonable choice also here
> since message buffer was entirely emptied.
>
> Addresses-Coverity: Explicit null dereferenced
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
>
Applied to for-current, thanks!
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-28 8:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-26 12:39 [RESEND PATCH] i2c: s3c2410: fix possible NULL pointer deref on read message after write Krzysztof Kozlowski
2021-05-28 8:17 ` Wolfram Sang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).