linux-kernel - Re: [PATCH v1] i2c: designware: Handle invalid SMBus block data response length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 2 Jun 2023 11:30:12 +0700
From:   Tam Chi Nguyen <tamnguyenchi@...eremail.onmicrosoft.com>
To:     Jarkko Nikula <jarkko.nikula@...ux.intel.com>,
        Tam Nguyen <tamnguyenchi@...amperecomputing.com>,
        linux-kernel@...r.kernel.org, linux-i2c@...r.kernel.org
Cc:     patches@...erecomputing.com, andriy.shevchenko@...ux.intel.com,
        mika.westerberg@...ux.intel.com, jsd@...ihalf.com,
        chuong@...amperecomputing.com, darren@...amperecomputing.com,
        stable@...r.kernel.org
Subject: Re: [PATCH v1] i2c: designware: Handle invalid SMBus block data
 response length

Hi Jarkko,

Before pushing the v2 patch, I have one more question to ask.

The commit f53f15ba5a85 ("i2c: designware: Get right data length"), you 
mentioned,
does not handle bit 11 set (on a HW where it's supported) correctly.
"tmp" was not marked with DW_IC_DATA_CMD_DAT when passing to 
i2c_dw_recv_len function.

So I plan to update it in the v2 patch by adding this
     regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
     tmp &= DW_IC_DATA_CMD_DAT;

My question is: does it need a separate patch for this change?

Best regards,
Tam Nguyen


On 5/25/2023 16:30, Tam Chi Nguyen wrote:
> Hi Jarkko
>
> On 5/24/2023 19:33, Jarkko Nikula wrote:
>> Hi
>>
>> On 5/23/23 11:21, Tam Nguyen wrote:
>>> In I2C_FUNC_SMBUS_BLOCK_DATA case, the I2C Designware driver does not
>>> handle correctly when it receives the length of SMBus block data
>>> response from SMBus slave device, which is outside the range 1-32 
>>> bytes.
>>> Consequently, the I2C Designware bus is stuck and cannot recover.
>>> Because if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be detected
>>> from the registers, the controller can be disabled if the STOP bit 
>>> is set.
>>> But it is only set after receiving block data response length.
>>>
>>> Hence, to prevent the bus from stuck condition, after receiving the
>>> invalid block data response length, the driver will read another byte
>>> with STOP bit set.
>>>
>>> Cc: stable@...r.kernel.org
>>> Signed-off-by: Tam Nguyen <tamnguyenchi@...amperecomputing.com>
>>> ---
>>>   drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++--
>>>   1 file changed, 13 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/i2c/busses/i2c-designware-master.c 
>>> b/drivers/i2c/busses/i2c-designware-master.c
>>> index 55ea91a63382..94dadd785ed0 100644
>>> --- a/drivers/i2c/busses/i2c-designware-master.c
>>> +++ b/drivers/i2c/busses/i2c-designware-master.c
>>> @@ -527,8 +527,19 @@ i2c_dw_read(struct dw_i2c_dev *dev)
>>>                 regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
>>>               /* Ensure length byte is a valid value */
>>> -            if (flags & I2C_M_RECV_LEN &&
>>> -                (tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX 
>>> && tmp > 0) {
>>> +            if (flags & I2C_M_RECV_LEN) {
>>> +                /*
>>> +                 * if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which 
>>> cannot be
>>> +                 * detected from the registers, the controller can be
>>> +                 * disabled if the STOP bit is set. But it is only set
>>> +                 * after receiving block data response length in
>>> +                 * I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read
>>> +                 * another byte with STOP bit set when the block data
>>> +                 * response length is invalid to complete the 
>>> transaction.
>>> +                 */
>>> +                if ((tmp & DW_IC_DATA_CMD_DAT) > 
>>> I2C_SMBUS_BLOCK_MAX || tmp == 0)
>>> +                    tmp = 1;
>>> +
>>>                   len = i2c_dw_recv_len(dev, tmp);
>>>               }
>>>               *buf++ = tmp;
>>
>> Looks otherwise good to me but I'm wondering the "tmp == 0" test can 
>> it have the bit 11 set (on a HW where it's supported) and should it 
>> be covered with DW_IC_DATA_CMD_DAT mask too? Please see commit 
>> f53f15ba5a85 ("i2c: designware: Get right data length").
>
> You're right. We should use the DW_IC_DATA_CMD_DAT mask to get the 
> data part if HW supports reading bit 11 from IC_DATA_CMD. I will 
> update it in v2.
>
> Best regards,
> Tam Nguyen
>