From patchwork Sun Jan 9 13:26:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heyi Guo X-Patchwork-Id: 12707779 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A13EAC433F5 for ; Sun, 9 Jan 2022 13:28:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:List-Subscribe:List-Help: List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date:Subject:Cc:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=+q/EDNEVQwWTYAEw6Kghcc2LSayxqD6LIUxVFHxX/xM=; b=uKfzbA/MxMLP49 W/fEfC7Y/YSNX/HO4aWquBqial8N2xtXJwqBUnF6W66+9mdR9mr4VNHG4FInmXY8SVfs3SsdQUWp8 ZiYs3BFrrPDoONUGP2iqAjsvbTYDNWU+AlnNae9yrVmehqER5gqLmEFHHFFFGO2auZtU2Fd1B5DHA ux0DPUtYGlhHcrXz2DOnNATBWSaKHg/L2TngTlQv3+CgVh2bx8YA6Vq0JX26s8weFDE6PrHqaJi+M eM6+FMD2kk12LQMA1tFsZqYIHLmcbOnfmW7KLSG86fP91lldNz0DxBwX+vwLO69BrXAgz6ED8zA0B GiOkv5yLcaZp4hJk4FuQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1n6YDs-007t4a-M6; Sun, 09 Jan 2022 13:27:00 +0000 Received: from out30-133.freemail.mail.aliyun.com ([115.124.30.133]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1n6YDo-007t2X-Op for linux-arm-kernel@lists.infradead.org; Sun, 09 Jan 2022 13:26:58 +0000 X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R901e4; CH=green; DM=||false|; DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=e01e04407; MF=guoheyi@linux.alibaba.com; NM=1; PH=DS; RN=11; SR=0; TI=SMTPD_---0V1Il5dP_1641734775; Received: from fdadf40dcbca.tbsite.net(mailfrom:guoheyi@linux.alibaba.com fp:SMTPD_---0V1Il5dP_1641734775) by smtp.aliyun-inc.com(127.0.0.1); Sun, 09 Jan 2022 21:26:48 +0800 From: Heyi Guo To: linux-kernel@vger.kernel.org Cc: Heyi Guo , Brendan Higgins , Benjamin Herrenschmidt , Joel Stanley , Andrew Jeffery , Philipp Zabel , linux-i2c@vger.kernel.org, openbmc@lists.ozlabs.org, linux-arm-kernel@lists.infradead.org, linux-aspeed@lists.ozlabs.org Subject: [PATCH] drivers/i2c-aspeed: avoid invalid memory reference after timeout Date: Sun, 9 Jan 2022 21:26:13 +0800 Message-Id: <20220109132613.122912-1-guoheyi@linux.alibaba.com> X-Mailer: git-send-email 2.17.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220109_052657_026649_66155212 X-CRM114-Status: UNSURE ( 9.38 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The memory will be freed by the caller if transfer timeout occurs, then it would trigger kernel panic if the peer device responds with something after timeout and triggers the interrupt handler of aspeed i2c driver. Set the msgs pointer to NULL to avoid invalid memory reference after timeout to fix this potential kernel panic. Signed-off-by: Heyi Guo ------- Cc: Brendan Higgins Cc: Benjamin Herrenschmidt Cc: Joel Stanley Cc: Andrew Jeffery Cc: Philipp Zabel Cc: linux-i2c@vger.kernel.org Cc: openbmc@lists.ozlabs.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-aspeed@lists.ozlabs.org --- drivers/i2c/busses/i2c-aspeed.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c index 67e8b97c0c950..3ab0396168680 100644 --- a/drivers/i2c/busses/i2c-aspeed.c +++ b/drivers/i2c/busses/i2c-aspeed.c @@ -708,6 +708,11 @@ static int aspeed_i2c_master_xfer(struct i2c_adapter *adap, spin_lock_irqsave(&bus->lock, flags); if (bus->master_state == ASPEED_I2C_MASTER_PENDING) bus->master_state = ASPEED_I2C_MASTER_INACTIVE; + /* + * All the buffers may be freed after returning to caller, so + * set msgs to NULL to avoid memory reference after freeing. + */ + bus->msgs = NULL; spin_unlock_irqrestore(&bus->lock, flags); return -ETIMEDOUT;