* [PATCH] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
@ 2022-12-20 16:15 Krzysztof Kozlowski
2022-12-21 6:43 ` Jiri Slaby
0 siblings, 1 reply; 3+ messages in thread
From: Krzysztof Kozlowski @ 2022-12-20 16:15 UTC (permalink / raw)
To: Andy Gross, Bjorn Andersson, Konrad Dybcio, Greg Kroah-Hartman,
Jiri Slaby, Satya Priya, linux-arm-msm, linux-serial,
linux-kernel
Cc: Krzysztof Kozlowski, stable
Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on
default RX FIFO depth, e.g. 16. Later during serial startup the
qcom_geni_serial_port_setup() updates the RX FIFO depth
(port->rx_fifo_depth) to match real device capabilities, e.g. to 32.
The RX UART handle code will read "port->rx_fifo_depth" number of words
into "port->rx_fifo" buffer, thus exceeding the bounds. This can be
observed in certain configurations with Qualcomm Bluetooth HCI UART
device and KASAN:
Bluetooth: hci0: QCA Product ID :0x00000010
Bluetooth: hci0: QCA SOC Version :0x400a0200
Bluetooth: hci0: QCA ROM Version :0x00000200
Bluetooth: hci0: QCA Patch Version:0x00000d2b
Bluetooth: hci0: QCA controller version 0x02000200
Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv
bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2
Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)
Bluetooth: hci0: QCA Failed to download patch (-2)
==================================================================
BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c
Write of size 4 at addr ffff279347d578c0 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0
show_stack+0x18/0x40
dump_stack_lvl+0x8c/0xb8
print_report+0x188/0x488
kasan_report+0xb4/0x100
__asan_store4+0x80/0xa4
handle_rx_uart+0xa8/0x18c
qcom_geni_serial_handle_rx+0x84/0x9c
qcom_geni_serial_isr+0x24c/0x760
__handle_irq_event_percpu+0x108/0x500
handle_irq_event+0x6c/0x110
handle_fasteoi_irq+0x138/0x2cc
generic_handle_domain_irq+0x48/0x64
If the RX FIFO depth changes after probe, be sure to resize the buffer.
Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
---
drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index b487823f0e61..1568fe69e3e8 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -864,9 +864,10 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
return IRQ_HANDLED;
}
-static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
+static int get_tx_fifo_size(struct qcom_geni_serial_port *port)
{
struct uart_port *uport;
+ u32 old_rx_fifo_depth = port->rx_fifo_depth;
uport = &port->uport;
port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se);
@@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se);
uport->fifosize =
(port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
+
+ if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) {
+ port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo,
+ port->rx_fifo_depth * sizeof(u32),
+ GFP_KERNEL);
+ if (!port->rx_fifo)
+ return -ENOMEM;
+ }
+
+ return 0;
}
@@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport)
u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT;
u32 proto;
u32 pin_swap;
+ int ret;
proto = geni_se_read_proto(&port->se);
if (proto != GENI_SE_UART) {
@@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport)
qcom_geni_serial_stop_rx(uport);
- get_tx_fifo_size(port);
+ ret = get_tx_fifo_size(port);
+ if (ret)
+ return ret;
writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
2022-12-20 16:15 [PATCH] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Krzysztof Kozlowski
@ 2022-12-21 6:43 ` Jiri Slaby
2022-12-21 7:49 ` Krzysztof Kozlowski
0 siblings, 1 reply; 3+ messages in thread
From: Jiri Slaby @ 2022-12-21 6:43 UTC (permalink / raw)
To: Krzysztof Kozlowski, Andy Gross, Bjorn Andersson, Konrad Dybcio,
Greg Kroah-Hartman, Satya Priya, linux-arm-msm, linux-serial,
linux-kernel
Cc: stable
On 20. 12. 22, 17:15, Krzysztof Kozlowski wrote:
> Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on
> default RX FIFO depth, e.g. 16. Later during serial startup the
> qcom_geni_serial_port_setup() updates the RX FIFO depth
> (port->rx_fifo_depth) to match real device capabilities, e.g. to 32.
...
> If the RX FIFO depth changes after probe, be sure to resize the buffer.
>
> Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
This patch LGTM, I only wonder:
> --- a/drivers/tty/serial/qcom_geni_serial.c
> +++ b/drivers/tty/serial/qcom_geni_serial.c
> @@ -864,9 +864,10 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
> return IRQ_HANDLED;
> }
>
> -static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
> +static int get_tx_fifo_size(struct qcom_geni_serial_port *port)
... why is this function dubbed get_tx_fifo_size(), provided it handles
rx fifo too? And it does not "get" the tx fifo size. In fact, the
function sets that :).
> {
> struct uart_port *uport;
> + u32 old_rx_fifo_depth = port->rx_fifo_depth;
>
> uport = &port->uport;
> port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se);
> @@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
> port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se);
> uport->fifosize =
> (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
> +
> + if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) {
> + port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo,
> + port->rx_fifo_depth * sizeof(u32),
> + GFP_KERNEL);
And now it even allocates memory.
So more appropriate name should be setup_fifos() or similar.
> + if (!port->rx_fifo)
> + return -ENOMEM;
> + }
> +
> + return 0;
--
js
suse labs
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
2022-12-21 6:43 ` Jiri Slaby
@ 2022-12-21 7:49 ` Krzysztof Kozlowski
0 siblings, 0 replies; 3+ messages in thread
From: Krzysztof Kozlowski @ 2022-12-21 7:49 UTC (permalink / raw)
To: Jiri Slaby, Andy Gross, Bjorn Andersson, Konrad Dybcio,
Greg Kroah-Hartman, Satya Priya, linux-arm-msm, linux-serial,
linux-kernel
Cc: stable
On 21/12/2022 07:43, Jiri Slaby wrote:
> On 20. 12. 22, 17:15, Krzysztof Kozlowski wrote:
>> Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on
>> default RX FIFO depth, e.g. 16. Later during serial startup the
>> qcom_geni_serial_port_setup() updates the RX FIFO depth
>> (port->rx_fifo_depth) to match real device capabilities, e.g. to 32.
> ...
>> If the RX FIFO depth changes after probe, be sure to resize the buffer.
>>
>> Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe")
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
>
> Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
>
> This patch LGTM, I only wonder:
>
>> --- a/drivers/tty/serial/qcom_geni_serial.c
>> +++ b/drivers/tty/serial/qcom_geni_serial.c
>> @@ -864,9 +864,10 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
>> return IRQ_HANDLED;
>> }
>>
>> -static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
>> +static int get_tx_fifo_size(struct qcom_geni_serial_port *port)
>
> ... why is this function dubbed get_tx_fifo_size(), provided it handles
> rx fifo too? And it does not "get" the tx fifo size. In fact, the
> function sets that :).
I reads the FIFO sizes from the device registers, so I guess that was
behind the naming.
>
>> {
>> struct uart_port *uport;
>> + u32 old_rx_fifo_depth = port->rx_fifo_depth;
>>
>> uport = &port->uport;
>> port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se);
>> @@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
>> port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se);
>> uport->fifosize =
>> (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
>> +
>> + if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) {
>> + port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo,
>> + port->rx_fifo_depth * sizeof(u32),
>> + GFP_KERNEL);
>
> And now it even allocates memory.
>
> So more appropriate name should be setup_fifos() or similar.
Sure, I'll rename it and keep your Rb tag.
>
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-12-21 7:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-20 16:15 [PATCH] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Krzysztof Kozlowski
2022-12-21 6:43 ` Jiri Slaby
2022-12-21 7:49 ` Krzysztof Kozlowski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).