linux-kernel - [PATCH 4.9 15/30] ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  4 Feb 2019 11:36:53 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org,
        Koen Vandeputte <koen.vandeputte@...ntric.com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Krzysztof Halasa <khalasa@...p.pl>,
        Tim Harvey <tharvey@...eworks.com>,
        Arnd Bergmann <arnd@...db.de>,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        Olof Johansson <olof@...om.net>,
        Robin Leblon <robin.leblon@...ntric.com>,
        Rob Herring <robh@...nel.org>,
        Russell King <linux@...linux.org.uk>
Subject: [PATCH 4.9 15/30] ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Koen Vandeputte <koen.vandeputte@...ntric.com>

commit 65dbb423cf28232fed1732b779249d6164c5999b upstream.

Originally, cns3xxx used its own functions for mapping, reading and
writing config registers.

Commit 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config
accessors") removed the internal PCI config write function in favor of
the generic one:

  cns3xxx_pci_write_config() --> pci_generic_config_write()

cns3xxx_pci_write_config() expected aligned addresses, being produced by
cns3xxx_pci_map_bus() while the generic one pci_generic_config_write()
actually expects the real address as both the function and hardware are
capable of byte-aligned writes.

This currently leads to pci_generic_config_write() writing to the wrong
registers.

For instance, upon ath9k module loading:

- driver ath9k gets loaded
- The driver wants to write value 0xA8 to register PCI_LATENCY_TIMER,
  located at 0x0D
- cns3xxx_pci_map_bus() aligns the address to 0x0C
- pci_generic_config_write() effectively writes 0xA8 into register 0x0C
  (CACHE_LINE_SIZE)

Fix the bug by removing the alignment in the cns3xxx mapping function.

Fixes: 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors")
Signed-off-by: Koen Vandeputte <koen.vandeputte@...ntric.com>
[lorenzo.pieralisi@....com: updated commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@....com>
Acked-by: Krzysztof Halasa <khalasa@...p.pl>
Acked-by: Tim Harvey <tharvey@...eworks.com>
Acked-by: Arnd Bergmann <arnd@...db.de>
CC: stable@...r.kernel.org	# v4.0+
CC: Bjorn Helgaas <bhelgaas@...gle.com>
CC: Olof Johansson <olof@...om.net>
CC: Robin Leblon <robin.leblon@...ntric.com>
CC: Rob Herring <robh@...nel.org>
CC: Russell King <linux@...linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 arch/arm/mach-cns3xxx/pcie.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus
 	} else /* remote PCI bus */
 		base = cnspci->cfg1_regs + ((busno & 0xf) << 20);
 
-	return base + (where & 0xffc) + (devfn << 12);
+	return base + where + (devfn << 12);
 }
 
 static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,