linux-kernel - Re: [PATCH i2c/slave-mqueue v5] i2c: slave-mqueue: add a slave backend to receive and queue messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ef5c197a-2dfc-a46c-88c2-bfec62aebeb7@linux.intel.com>
Date:   Thu, 30 May 2019 09:39:05 +0800
From:   "Wang, Haiyue" <haiyue.wang@...ux.intel.com>
To:     Eduardo Valentin <eduval@...zon.com>
Cc:     wsa@...-dreams.de, brendanhiggins@...gle.com,
        linux-i2c@...r.kernel.org, linux-kernel@...r.kernel.org,
        openbmc@...ts.ozlabs.org, jarkko.nikula@...ux.intel.com,
        andriy.shevchenko@...el.com, jae.hyun.yoo@...ux.intel.com
Subject: Re: [PATCH i2c/slave-mqueue v5] i2c: slave-mqueue: add a slave
 backend to receive and queue messages


在 2019-05-30 07:11, Eduardo Valentin 写道:
>>> this code goes access and modify data here, e.g. msg->len and msg->buf.
>>>
>>> On this case (I2C_SLAVE_WRITE_RECEIVED), this code wont protect access.
>>>
>>> This can cause concurrence issues if you receive an IRQ when the user
>>> is on your bin_read().
>> User will not touch 'msg = mq->curr;', just touch 'msg =
>> &mq->queue[mq->out];'
> What happens if mq->curr == mq->queue[mq->out]?
>
1. The Read will check.

+	spin_lock_irqsave(&mq->lock, flags);
+	if (mq->out != mq->in) {
+		msg = &mq->queue[mq->out];

2. Flush the oldeast message. ^_^

+	case I2C_SLAVE_STOP:
+		if (unlikely(mq->truncated || msg->len < 2))
+			break;
+
+		spin_lock(&mq->lock);
+		mq->in = MQ_QUEUE_NEXT(mq->in);
+		mq->curr = &mq->queue[mq->in];
+		mq->curr->len = 0;
+
+		/* Flush the oldest message */
+		if (mq->out == mq->in)
+			mq->out = MQ_QUEUE_NEXT(mq->out);
+		spin_unlock(&mq->lock);