linux-kernel - Re: [PATCH] spi: spi-geni-qcom: Fix NULL pointer access in geni_spi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <160764316821.1580929.18177257779550490986@swboyd.mtv.corp.google.com>
Date:   Thu, 10 Dec 2020 15:32:48 -0800
From:   Stephen Boyd <swboyd@...omium.org>
To:     Doug Anderson <dianders@...omium.org>
Cc:     Roja Rani Yarubandi <rojay@...eaurora.org>,
        Mark Brown <broonie@...nel.org>,
        Andy Gross <agross@...nel.org>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        linux-arm-msm <linux-arm-msm@...r.kernel.org>,
        linux-spi <linux-spi@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Akash Asthana <akashast@...eaurora.org>,
        msavaliy@....qualcomm.com
Subject: Re: [PATCH] spi: spi-geni-qcom: Fix NULL pointer access in geni_spi_isr

Quoting Doug Anderson (2020-12-10 15:07:39)
> Hi,
> 
> On Thu, Dec 10, 2020 at 2:58 PM Stephen Boyd <swboyd@...omium.org> wrote:
> > right? It will only ensure that other irq handlers have completed, which
> > may be a problem, but not the only one.
> >
> > TL;DR: Peek at the irq status register in the timeout logic and skip it
> > if the irq is pending?
> 
> I don't have tons of experience with synchronize_irq(), but the
> function comment seems to indicate that as long as the interrupt is
> pending synchronize_irq() will do what we want even if the CPU that
> should handle the interrupt is in an irqsoff section.  Digging a
> little bit I guess it relies upon the interrupt controller being able
> to read this state, but (hopefully) the GIC can?

I didn't read synchronize_irq() more than the single line summary. I
thought it would only make sure other irq handlers have finished, which
is beside the point of some long section of code that has disabled irqs
on CPU0 with local_irq_disable(). And further more, presumably the irq
handler could be threaded, and then we could put a sufficiently large
msleep() at the start of geni_spi_isr() and see the same problem?

> 
> If it doesn't work like I think it does, I'd be OK with peeking in the
> IRQ status register, but we shouldn't _skip_ the logic IMO.  As long
> as we believe that an interrupt could happen in the future we
> shouldn't return from handle_fifo_timeout().  It's impossible to
> reason about how future transfers would work if the pending interrupt
> from the previous transfer could fire at any point.

Right. I just meant skip the timeout handling logic. We'd have to go
back to the timeout and keep waiting until the irq handler can run and
complete the completion variable.

I forgot that this is half handled in the spi core though. Peeking at
m_irq doesn't look very easy to implement. It certainly seems like this
means the timeout handler is busted and the diagram earlier could
indicate that spi core is driving this logic from
spi_transfer_one_message().

So why don't we check for cur_xfer being NULL in the rx/tx handling
paths too and bail out there? Does the FIFO need to be cleared out in
such a situation that spi core thinks a timeout happened but there's RX
data according to m_irq? Do we need to read it all and throw it away? Or
does the abort/cancel clear out the RX fifo?

----8<-----
diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index 25810a7eef10..651b1720401a 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -522,10 +522,12 @@ static irqreturn_t geni_spi_isr(int irq, void *data)
 	spin_lock(&mas->lock);

 	if ((m_irq & M_RX_FIFO_WATERMARK_EN) || (m_irq & M_RX_FIFO_LAST_EN))
-		geni_spi_handle_rx(mas);
+		if (mas->cur_xfer)
+			geni_spi_handle_rx(mas);

 	if (m_irq & M_TX_FIFO_WATERMARK_EN)
-		geni_spi_handle_tx(mas);
+		if (mas->cur_xfer)
+			geni_spi_handle_tx(mas);

 	if (m_irq & M_CMD_DONE_EN) {
 		if (mas->cur_xfer) {