linux-kernel - [PATCH 2/2] mfd: intel-m10-bmc: start with the last SOP on phy rx buffer parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Jul 2020 12:34:56 +0800
From:   Xu Yilun <yilun.xu@...el.com>
To:     lee.jones@...aro.org, linux-kernel@...r.kernel.org
Cc:     trix@...hat.com, yilun.xu@...el.com,
        matthew.gerlach@...ux.intel.com, russell.h.weight@...el.com,
        lgoncalv@...hat.com
Subject: [PATCH 2/2] mfd: intel-m10-bmc: start with the last SOP on phy rx buffer parsing

From: Matthew Gerlach <matthew.gerlach@...ux.intel.com>

This patch works around a bug in the SPI Slave to Avalon Master bridge.
The SPI slave will send an unexpected extra SOP in the following case.

One in approximately one million read requests results in an apparant
stall on the avalon bus where the SPI slave inserts IDLE characters. When
the stall is over, the slave sends an extra SOP character instead of the
0x7c indicating channel. The other characters are correct.

To eliminate the impact of the bug, this patch changes to look for the
last SOP as the start point of the valid phy rx data.

Signed-off-by: Matthew Gerlach <matthew.gerlach@...ux.intel.com>
Signed-off-by: Xu Yilun <yilun.xu@...el.com>
Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@...hat.com>
Signed-off-by: Tom Rix <trix@...hat.com>
---
 drivers/mfd/intel-spi-avmm.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/intel-spi-avmm.c b/drivers/mfd/intel-spi-avmm.c
index 2604657..e4443b7 100644
--- a/drivers/mfd/intel-spi-avmm.c
+++ b/drivers/mfd/intel-spi-avmm.c
@@ -431,14 +431,14 @@ static int pkt_phy_rx_parse(struct device *dev,
 {
 	char *b, *p;
 
-	b = phy_buf;
 	p = trans_buf;
 
-	/* Find the SOP */
-	while (b < phy_buf + phy_len && *b != PKT_SOP)
-		b++;
+	/* Find the last SOP */
+	b = (phy_buf + phy_len) - 1;
+	while (b >= phy_buf && *b != PKT_SOP)
+		b--;
 
-	if (b >= phy_buf + phy_len) {
+	if (b < phy_buf) {
 		dev_err(dev, "%s no SOP\n", __func__);
 		return -EINVAL;
 	}
-- 
2.7.4