linux-kernel - Re: [PATCH v3 3/4] lib: logic_pio: Reject accesses to unregistered CPU MMIO regions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 5 Apr 2019 09:10:27 +0100
From:   John Garry <john.garry@...wei.com>
To:     Bjorn Helgaas <helgaas@...nel.org>,
        Guenter Roeck <linux@...ck-us.net>
CC:     <wangkefeng.wang@...wei.com>, <lorenzo.pieralisi@....com>,
        <arnd@...db.de>, <rafael@...nel.org>, <linux-pci@...r.kernel.org>,
        <will.deacon@....com>, <linux-kernel@...r.kernel.org>,
        <linuxarm@...wei.com>, <andy.shevchenko@...il.com>,
        <catalin.marinas@....com>, <bp@...e.de>,
        <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH v3 3/4] lib: logic_pio: Reject accesses to unregistered
 CPU MMIO regions

On 04/04/2019 19:58, Bjorn Helgaas wrote:
> On Thu, Apr 04, 2019 at 10:43:36AM -0700, Guenter Roeck wrote:
>> On Thu, Apr 04, 2019 at 05:52:35PM +0100, John Garry wrote:
>>>>> Note that the f71805f driver does not call
>>>>> request_{muxed_}region(), as it should.
>>>
>>>> ... which is the real problem, one that is not solved by this
>>>> patch. This may result in parallel and descructive accesses if
>>>> there is another device on the LPC bus, and another driver
>>>> accessing that device. Personally I'd rather have
>>>> request_muxed_region() added to the f71805f driver.
>>>
>>> Right, we should and will still fix f71805f. If you recall, I did
>>> have the f71805f fix in the v1 series, but you committed that it
>>> was orthogonal, so I decided to take it out of this work for now.
>>>
>>> And even if we fix up f71805f and other known drivers which don't
>>> call request_muxed_region(), we still need to police against these
>>> rogue accesses, which is what this patch attempts to do.
>>>
>> Do we ? I am personally not convinced that LPC accesses _have_ to
>> occur through PCI on any given system.
>
> On current systems, I suspect ISA/LPC devices are typically connected
> via a PCI-to-ISA/LPC bridge.  But AFAIK there's no actual requirement
> for that bridge, and there certainly *were* systems with ISA devices
> but no PCI at all.
>
> IMO, if you want to build ISA drivers on your arch, you need to make
> sure the inb() probing done by those drivers works like it does on
> x86.  If there's no device there, the inb() should return 0xff with no
> fuss and no crash.

Right, and this is what I am attempting to do here.

So today a call to request_muxed_region() can still succeed even if no 
IO space mapped.

As such, even well-behaved drivers like f71882fg can still crash the 
system, as noted in RFC patch 1/4 ("resource: Request IO port regions 
from children of ioport_resource").

Thanks,
John

>
> Bjorn
>
> .
>