linux-kernel - Re: Misaligned Access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Nov 2018 19:41:56 +0000
From:   Vineet Gupta <vineet.gupta1@...opsys.com>
To:     Vitor Soares <vitor.soares@...opsys.com>,
        Alexey Brodkin <alexey.brodkin@...opsys.com>,
        Joao Pinto <joao.pinto@...opsys.com>,
        Jose Abreu <jose.abreu@...opsys.com>
CC:     arcml <linux-snps-arc@...ts.infradead.org>,
        lkml <linux-kernel@...r.kernel.org>,
        Arnd Bergmann <arnd@...db.de>
Subject: Re: Misaligned Access

+CC lkml, Arnd : subject matter expert

On 11/21/18 10:06 AM, Vitor Soares wrote:
> I use the follow function to get data from a RX Fifo.
>
>
> static void dw_i3c_master_read_rx_fifo(struct dw_i3c_master *master,
>                         u8 *bytes, int nbytes)
> {
>      readsl(master->regs + RX_TX_DATA_PORT, bytes, nbytes / 4);

So the semantics are reading the same fifo register N times, to get the N words,
hence read*s*l is appropriate. That however expects the buffer to be 4 bytes
aligned, hence your issue. You can't possibly use the reads*b* as we want the

The obvious but crude hack is to use a temp array for readsl and then copy over
using memcpy, but I'm sure there are better ways, @Arnd ? To summarize is issue is
a driver triggering unaligned access due to the misinteraction of API (driver get
an unaligned u8 *) which goes against expectations of io accessor readl  (needed
since the register contents are 4 bytes)

>      if (nbytes & 3) {
>          u32 tmp;
>
>          readsl(master->regs + RX_TX_DATA_PORT, &tmp, 1);
>          memcpy(bytes + (nbytes & ~3), &tmp, nbytes & 3);
>      }
> }
>
>
> and the pointer u8 *bytes is what is unaligned and breaks when inside of 
> realdsl() it does:
>
>      *buf++ = x;
>
>
> Note that the u8 *bytes pointer is the __u8 *buf of the i2c_msg struct.