linux-kernel - Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190427071025.hdrm3e5abnl4yock@mobilestation>
Date:   Sat, 27 Apr 2019 10:10:27 +0300
From:   Serge Semin <fancer.lancer@...il.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Richard Leitner <richard.leitner@...data.com>,
        Serge Semin <Sergey.Semin@...latforms.ru>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides

On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > state. This is the mode the hub is supposed to be to let this driver
> > work correctly. But a race condition might happen right after reset
> > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > function. In case if the reset pin is handled by a i2c GPIO expander,
> > which is also placed at the same i2c-bus segment as the usb251x
> > SMB-interface connected to, then the hub reset clearance might
> > cause the CFG_SEL[0] being latched in unpredictable state. So
> > sometimes the hub configuration mode might be 0x1 (as expected),
> > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > interface activated and consequently causes this driver failure.
> > 
> > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > it doesn't, we can safely block the segment for the time the reset is
> > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > just return an error. If we locked the i2c-bus segment and tried to
> > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> > 
> > Signed-off-by: Serge Semin <fancer.lancer@...il.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> 
> I signed off on this?  Where?  When?
> 
> never add a s-o-b line that you did not create, that implies a legal
> agreement.
> 

Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
since you already added the first version of this into linux-next tree. But
apparently copy-pasted and left as is...

-Sergey

> greg k-h