linux-kernel - [PATCH -next] i2c: designware: Fix improper usage of readl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220218133348.628962-1-jsd@semihalf.com>
Date:   Fri, 18 Feb 2022 14:33:48 +0100
From:   Jan Dabros <jsd@...ihalf.com>
To:     linux-kernel@...r.kernel.org, linux-i2c@...r.kernel.org,
        jarkko.nikula@...ux.intel.com, andriy.shevchenko@...ux.intel.com
Cc:     wsa@...nel.org, rrangel@...omium.org, upstream@...ihalf.com,
        jsd@...ihalf.com, kernel test robot <lkp@...el.com>
Subject: [PATCH -next] i2c: designware: Fix improper usage of readl

Kernel test robot reported incorrect type in argument 1 of readl(), but
more importantly it brought attention that MMIO accessor shouldn't be
used in this case, since req->hdr.status is part of a command-response
buffer in system memory.

Since its value may be altered by PSP outside of the scope of current
thread (somehow similar to IRQ handler case), we need to use
READ_ONCE() to ensure compiler won't optimize this call.

Fix also 'status' variable type to reflect that corresponding field in
command-response buffer is platform-independent u32.

Signed-off-by: Jan Dabros <jsd@...ihalf.com>
Reported-by: kernel test robot <lkp@...el.com>
---
 drivers/i2c/busses/i2c-designware-amdpsp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-designware-amdpsp.c b/drivers/i2c/busses/i2c-designware-amdpsp.c
index 752e0024db03..c64e459afb5c 100644
--- a/drivers/i2c/busses/i2c-designware-amdpsp.c
+++ b/drivers/i2c/busses/i2c-designware-amdpsp.c
@@ -160,9 +160,10 @@ static int psp_send_cmd(struct psp_i2c_req *req)
 /* Helper to verify status returned by PSP */
 static int check_i2c_req_sts(struct psp_i2c_req *req)
 {
-	int status;
+	u32 status;
 
-	status = readl(&req->hdr.status);
+	/* Status field in command-response buffer is updated by PSP */
+	status = READ_ONCE(req->hdr.status);
 
 	switch (status) {
 	case PSP_I2C_REQ_STS_OK:
-- 
2.35.1.265.g69c8d7142f-goog