linux-kernel - [PATCH] i2c: designware: I2C unexpected interrupt handling will cause kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Nov 2021 14:57:59 +0800
From:   huangbibo <huangbibo@...ontech.com>
To:     linux-i2c@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, jarkko.nikula@...ux.intel.com,
        mika.westerberg@...ux.intel.com, andriy.shevchenko@...ux.intel.com,
        p.zabel@...gutronix.de, huangbibo <huangbibo@...ontech.com>
Subject: [PATCH] i2c: designware: I2C unexpected interrupt handling will cause kernel panic

I2C interrupts may be triggered unexpectedly,
such as programs that directly access I2C registers,
bus conflicts caused by hardware design defects, etc.
These can cause null pointer reference errors and kernel panic.

kernel log:
[   52.676442] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
...
[   52.816536] Workqueue: efi_rts_wq efi_call_rts
[   52.820968] pstate: 60000085 (nZCv daIf -PAN -UAO)
[   52.825753] pc : i2c_dw_isr+0x36c/0x5e0 [i2c_designware_core]
[   52.831487] lr : i2c_dw_isr+0x88/0x5e0 [i2c_designware_core]
[   52.837134] sp : ffff8020fff17650
[   52.924451] Call trace:
[   52.926888]  i2c_dw_isr+0x36c/0x5e0 [i2c_designware_core]
...
[   52.957394]  gic_handle_irq+0x7c/0x178
[   52.961130]  el1_irq+0xb0/0x140
[   52.964259]  0x21291d30
[   52.983729]  0x21160938
[   52.986164]  __efi_rt_asm_wrapper+0x28/0x44
[   52.990335]  efi_call_rts+0x78/0x448
[   53.019021] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: huangbibo <huangbibo@...ontech.com>
---
 drivers/i2c/busses/i2c-designware-master.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index 2871cf2ee8b4..6af1ede38253 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -631,8 +631,14 @@ static int i2c_dw_irq_handler_master(struct dw_i2c_dev *dev)
 	if (stat & DW_IC_INTR_RX_FULL)
 		i2c_dw_read(dev);
 
-	if (stat & DW_IC_INTR_TX_EMPTY)
-		i2c_dw_xfer_msg(dev);
+	if (stat & DW_IC_INTR_TX_EMPTY) {
+		if (dev->msgs) {
+			i2c_dw_xfer_msg(dev);
+		} else { //null  pointer
+			i2c_dw_disable_int(dev);
+			return 0;
+		}
+	}
 
 	/*
 	 * No need to modify or disable the interrupt mask here.
-- 
2.20.1