linux-kernel - [PATCH] drivers/gpu/drm/ast: Fix infinite loop if read fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1609122469-217583-1-git-send-email-bodefang@126.com>
Date:   Mon, 28 Dec 2020 10:27:49 +0800
From:   Defang Bo <bodefang@....com>
To:     airlied@...hat.com, tzimmermann@...e.de, airlied@...ux.ie,
        daniel@...ll.ch
Cc:     dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        Defang Bo <bodefang@....com>
Subject: [PATCH] drivers/gpu/drm/ast: Fix infinite loop if read fails

[Why]
Similar to commit <298360af3>("drivers/gpu/drm/ast: Fix infinite loop if read fails"),
ast_init_dram_reg() configures a window in order to access BMC memory.
A BMC register can be configured to disallow this, and if so, causes
an infinite loop in the ast driver which renders the system unusable.

[How]
Fix this by erroring out if an error is detected.

Signed-off-by: Defang Bo <bodefang@....com>
---
 drivers/gpu/drm/ast/ast_post.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index 8902c2f..8bcd1e6 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -287,7 +287,8 @@ static void ast_init_dram_reg(struct drm_device *dev)
 			ast_write32(ast, 0x10100, 0xa8);
 
 			do {
-				;
+				if (pci_channel_offline(dev->pdev))
+					return;
 			} while (ast_read32(ast, 0x10100) != 0xa8);
 		} else {/* AST2100/1100 */
 			if (ast->chip == AST2100 || ast->chip == 2200)
@@ -299,12 +300,14 @@ static void ast_init_dram_reg(struct drm_device *dev)
 			ast_write32(ast, 0xf000, 0x1);
 			ast_write32(ast, 0x12000, 0x1688A8A8);
 			do {
-				;
+				if (pci_channel_offline(dev->pdev))
+					return;
 			} while (ast_read32(ast, 0x12000) != 0x01);
 
 			ast_write32(ast, 0x10000, 0xfc600309);
 			do {
-				;
+				if (pci_channel_offline(dev->pdev))
+					return;
 			} while (ast_read32(ast, 0x10000) != 0x01);
 		}
 
-- 
2.7.4