| Message ID | 1619481538-4435-1-git-send-email-bbhatt@codeaurora.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | bus: mhi: core: Validate channel ID when processing command completions | expand |
On 4/26/21 4:58 PM, Bhaumik Bhatt wrote: > MHI reads the channel ID from the event ring element sent by the > device which can be any value between 0 and 255. In order to > prevent any out of bound accesses, add a check against the maximum > number of channels supported by the controller and those channels > not configured yet so as to skip processing of that event ring > element. > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> > --- Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
On 4/26/2021 5:58 PM, Bhaumik Bhatt wrote: > MHI reads the channel ID from the event ring element sent by the > device which can be any value between 0 and 255. In order to > prevent any out of bound accesses, add a check against the maximum > number of channels supported by the controller and those channels > not configured yet so as to skip processing of that event ring > element. > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> > --- Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
On Mon, Apr 26, 2021 at 04:58:58PM -0700, Bhaumik Bhatt wrote: > MHI reads the channel ID from the event ring element sent by the > device which can be any value between 0 and 255. In order to > prevent any out of bound accesses, add a check against the maximum > number of channels supported by the controller and those channels > not configured yet so as to skip processing of that event ring > element. > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Thanks, Mani > --- > drivers/bus/mhi/core/main.c | 15 ++++++++++----- > 1 file changed, 10 insertions(+), 5 deletions(-) > > diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c > index 22acde1..ed07421 100644 > --- a/drivers/bus/mhi/core/main.c > +++ b/drivers/bus/mhi/core/main.c > @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, > cmd_pkt = mhi_to_virtual(mhi_ring, ptr); > > chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); > - mhi_chan = &mhi_cntrl->mhi_chan[chan]; > - write_lock_bh(&mhi_chan->lock); > - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > - complete(&mhi_chan->completion); > - write_unlock_bh(&mhi_chan->lock); > + WARN_ON(chan >= mhi_cntrl->max_chan); > + > + if (chan < mhi_cntrl->max_chan && > + mhi_cntrl->mhi_chan[chan].configured) { > + mhi_chan = &mhi_cntrl->mhi_chan[chan]; > + write_lock_bh(&mhi_chan->lock); > + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > + complete(&mhi_chan->completion); > + write_unlock_bh(&mhi_chan->lock); > + } > > mhi_del_ring_element(mhi_cntrl, mhi_ring); > } > -- > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > a Linux Foundation Collaborative Project >
On Mon, Apr 26, 2021 at 04:58:58PM -0700, Bhaumik Bhatt wrote: > MHI reads the channel ID from the event ring element sent by the > device which can be any value between 0 and 255. In order to > prevent any out of bound accesses, add a check against the maximum > number of channels supported by the controller and those channels > not configured yet so as to skip processing of that event ring > element. > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> Applied to mhi-next! Thanks, Mani > --- > drivers/bus/mhi/core/main.c | 15 ++++++++++----- > 1 file changed, 10 insertions(+), 5 deletions(-) > > diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c > index 22acde1..ed07421 100644 > --- a/drivers/bus/mhi/core/main.c > +++ b/drivers/bus/mhi/core/main.c > @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, > cmd_pkt = mhi_to_virtual(mhi_ring, ptr); > > chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); > - mhi_chan = &mhi_cntrl->mhi_chan[chan]; > - write_lock_bh(&mhi_chan->lock); > - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > - complete(&mhi_chan->completion); > - write_unlock_bh(&mhi_chan->lock); > + WARN_ON(chan >= mhi_cntrl->max_chan); > + > + if (chan < mhi_cntrl->max_chan && > + mhi_cntrl->mhi_chan[chan].configured) { > + mhi_chan = &mhi_cntrl->mhi_chan[chan]; > + write_lock_bh(&mhi_chan->lock); > + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > + complete(&mhi_chan->completion); > + write_unlock_bh(&mhi_chan->lock); > + } > > mhi_del_ring_element(mhi_cntrl, mhi_ring); > } > -- > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > a Linux Foundation Collaborative Project >
On Mon, May 24, 2021 at 10:12:28AM +0530, Manivannan Sadhasivam wrote: > On Mon, Apr 26, 2021 at 04:58:58PM -0700, Bhaumik Bhatt wrote: > > MHI reads the channel ID from the event ring element sent by the > > device which can be any value between 0 and 255. In order to > > prevent any out of bound accesses, add a check against the maximum > > number of channels supported by the controller and those channels > > not configured yet so as to skip processing of that event ring > > element. > > > > Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") > > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> > > Applied to mhi-next! > Sorry this has been applied to mhi-next! Thanks, Mani > Thanks, > Mani > > > --- > > drivers/bus/mhi/core/main.c | 15 ++++++++++----- > > 1 file changed, 10 insertions(+), 5 deletions(-) > > > > diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c > > index 22acde1..ed07421 100644 > > --- a/drivers/bus/mhi/core/main.c > > +++ b/drivers/bus/mhi/core/main.c > > @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, > > cmd_pkt = mhi_to_virtual(mhi_ring, ptr); > > > > chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); > > - mhi_chan = &mhi_cntrl->mhi_chan[chan]; > > - write_lock_bh(&mhi_chan->lock); > > - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > > - complete(&mhi_chan->completion); > > - write_unlock_bh(&mhi_chan->lock); > > + WARN_ON(chan >= mhi_cntrl->max_chan); > > + > > + if (chan < mhi_cntrl->max_chan && > > + mhi_cntrl->mhi_chan[chan].configured) { > > + mhi_chan = &mhi_cntrl->mhi_chan[chan]; > > + write_lock_bh(&mhi_chan->lock); > > + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); > > + complete(&mhi_chan->completion); > > + write_unlock_bh(&mhi_chan->lock); > > + } > > > > mhi_del_ring_element(mhi_cntrl, mhi_ring); > > } > > -- > > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > > a Linux Foundation Collaborative Project > >
diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c index 22acde1..ed07421 100644 --- a/drivers/bus/mhi/core/main.c +++ b/drivers/bus/mhi/core/main.c @@ -773,11 +773,16 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, cmd_pkt = mhi_to_virtual(mhi_ring, ptr); chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); - mhi_chan = &mhi_cntrl->mhi_chan[chan]; - write_lock_bh(&mhi_chan->lock); - mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); - complete(&mhi_chan->completion); - write_unlock_bh(&mhi_chan->lock); + WARN_ON(chan >= mhi_cntrl->max_chan); + + if (chan < mhi_cntrl->max_chan && + mhi_cntrl->mhi_chan[chan].configured) { + mhi_chan = &mhi_cntrl->mhi_chan[chan]; + write_lock_bh(&mhi_chan->lock); + mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); + complete(&mhi_chan->completion); + write_unlock_bh(&mhi_chan->lock); + } mhi_del_ring_element(mhi_cntrl, mhi_ring); }
MHI reads the channel ID from the event ring element sent by the device which can be any value between 0 and 255. In order to prevent any out of bound accesses, add a check against the maximum number of channels supported by the controller and those channels not configured yet so as to skip processing of that event ring element. Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> --- drivers/bus/mhi/core/main.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)