linux-kernel - Re: [PATCH v1] i2c: designware: Handle invalid SMBus block data response length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6def5691-2462-9707-f75a-09931d26d4af@amperemail.onmicrosoft.com>
Date:   Thu, 25 May 2023 16:30:26 +0700
From:   Tam Chi Nguyen <tamnguyenchi@...eremail.onmicrosoft.com>
To:     Jarkko Nikula <jarkko.nikula@...ux.intel.com>,
        Tam Nguyen <tamnguyenchi@...amperecomputing.com>,
        linux-kernel@...r.kernel.org, linux-i2c@...r.kernel.org
Cc:     patches@...erecomputing.com, andriy.shevchenko@...ux.intel.com,
        mika.westerberg@...ux.intel.com, jsd@...ihalf.com,
        chuong@...amperecomputing.com, darren@...amperecomputing.com,
        stable@...r.kernel.org
Subject: Re: [PATCH v1] i2c: designware: Handle invalid SMBus block data
 response length

Hi Jarkko

On 5/24/2023 19:33, Jarkko Nikula wrote:
> Hi
>
> On 5/23/23 11:21, Tam Nguyen wrote:
>> In I2C_FUNC_SMBUS_BLOCK_DATA case, the I2C Designware driver does not
>> handle correctly when it receives the length of SMBus block data
>> response from SMBus slave device, which is outside the range 1-32 bytes.
>> Consequently, the I2C Designware bus is stuck and cannot recover.
>> Because if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be detected
>> from the registers, the controller can be disabled if the STOP bit is 
>> set.
>> But it is only set after receiving block data response length.
>>
>> Hence, to prevent the bus from stuck condition, after receiving the
>> invalid block data response length, the driver will read another byte
>> with STOP bit set.
>>
>> Cc: stable@...r.kernel.org
>> Signed-off-by: Tam Nguyen <tamnguyenchi@...amperecomputing.com>
>> ---
>>   drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++--
>>   1 file changed, 13 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/i2c/busses/i2c-designware-master.c 
>> b/drivers/i2c/busses/i2c-designware-master.c
>> index 55ea91a63382..94dadd785ed0 100644
>> --- a/drivers/i2c/busses/i2c-designware-master.c
>> +++ b/drivers/i2c/busses/i2c-designware-master.c
>> @@ -527,8 +527,19 @@ i2c_dw_read(struct dw_i2c_dev *dev)
>>                 regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
>>               /* Ensure length byte is a valid value */
>> -            if (flags & I2C_M_RECV_LEN &&
>> -                (tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX && 
>> tmp > 0) {
>> +            if (flags & I2C_M_RECV_LEN) {
>> +                /*
>> +                 * if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which 
>> cannot be
>> +                 * detected from the registers, the controller can be
>> +                 * disabled if the STOP bit is set. But it is only set
>> +                 * after receiving block data response length in
>> +                 * I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read
>> +                 * another byte with STOP bit set when the block data
>> +                 * response length is invalid to complete the 
>> transaction.
>> +                 */
>> +                if ((tmp & DW_IC_DATA_CMD_DAT) > I2C_SMBUS_BLOCK_MAX 
>> || tmp == 0)
>> +                    tmp = 1;
>> +
>>                   len = i2c_dw_recv_len(dev, tmp);
>>               }
>>               *buf++ = tmp;
>
> Looks otherwise good to me but I'm wondering the "tmp == 0" test can 
> it have the bit 11 set (on a HW where it's supported) and should it be 
> covered with DW_IC_DATA_CMD_DAT mask too? Please see commit 
> f53f15ba5a85 ("i2c: designware: Get right data length").

You're right. We should use the DW_IC_DATA_CMD_DAT mask to get the data 
part if HW supports reading bit 11 from IC_DATA_CMD. I will update it in v2.

Best regards,
Tam Nguyen