linux-kernel - [ 010/100] watchdog: sp5100_tco: Fix wrong indirect I/O access for getting value of reserved bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20130312223124.039360804@linuxfoundation.org>
Date:	Tue, 12 Mar 2013 15:30:55 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	linux-kernel@...r.kernel.org
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	stable@...r.kernel.org, Takahisa Tanaka <mc74hc00@...il.com>,
	Paul Menzel <paulepanter@...rs.sourceforge.net>,
	Wim Van Sebroeck <wim@...ana.be>
Subject: [ 010/100] watchdog: sp5100_tco: Fix wrong indirect I/O access for getting value of reserved bits

3.8-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takahisa Tanaka <mc74hc00@...il.com>

commit 10ab329b5db7e592a3a60b4594e4e5f40b60c45c upstream.

In case of SB800 or later chipset and re-programming MMIO address(*),
sp5100_tco module may read incorrect value of reserved bit, because the module
reads a value from an incorrect I/O address. However, this bug doesn't cause
a problem, because when re-programming MMIO address, by chance the module
writes zero (this is BIOS's default value) to the low three bits of register.
* In most cases, PC with SB8x0 or later chipset doesn't need to re-programming
  MMIO address, because such PC can enable AcpiMmio and can use 0xfed80b00 for
  watchdog register base address.

This patch fixes this bug.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=43176
Signed-off-by: Takahisa Tanaka <mc74hc00@...il.com>
Tested-by: Paul Menzel <paulepanter@...rs.sourceforge.net>
Signed-off-by: Wim Van Sebroeck <wim@...ana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 drivers/watchdog/sp5100_tco.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/watchdog/sp5100_tco.c
+++ b/drivers/watchdog/sp5100_tco.c
@@ -500,14 +500,15 @@ static unsigned char sp5100_tco_setupdev
 	/* Restore to the low three bits, if chipset is SB8x0(or later) */
 	if (sp5100_tco_pci->revision >= 0x40) {
 		u8 reserved_bit;
-		reserved_bit = inb(base_addr) & 0x7;
+		outb(base_addr+0, index_reg);
+		reserved_bit = inb(data_reg) & 0x7;
 		val |= (u32)reserved_bit;
 	}
 
 	/* Re-programming the watchdog timer base address */
 	outb(base_addr+0, index_reg);
 	/* Low three bits of BASE are reserved */
-	outb((val >>  0) & 0xf8, data_reg);
+	outb((val >>  0) & 0xff, data_reg);
 	outb(base_addr+1, index_reg);
 	outb((val >>  8) & 0xff, data_reg);
 	outb(base_addr+2, index_reg);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/