linux-kernel - Re: [PATCH v1 RESEND] slimbus: messaging: Free transaction ID in delayed interrupt scenario

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8055a3db-5bb3-4550-b434-28a9df85c7a1@linaro.org>
Date: Fri, 20 Dec 2024 17:29:01 +0000
From: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
To: Visweswara Tanuku <quic_vtanuku@...cinc.com>
Cc: linux-sound@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 RESEND] slimbus: messaging: Free transaction ID in
 delayed interrupt scenario



On 02/12/2024 13:57, Visweswara Tanuku wrote:
> In case of interrupt delay for any reason, slim_do_transfer()
> returns timeout error but the transaction ID (TID) is not freed.
> This results into invalid memory access inside
> qcom_slim_ngd_rx_msgq_cb() due to invalid TID.
> 
> Fix the issue by freeing the TID in slim_do_transfer() before
> returning timeout error to avoid invalid memory access.
> 
> Call trace:
> __memcpy_fromio+0x20/0x190
> qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]
> vchan_complete+0x2a0/0x4a0
> tasklet_action_common+0x274/0x700
> tasklet_action+0x28/0x3c
> _stext+0x188/0x620
> run_ksoftirqd+0x34/0x74
> smpboot_thread_fn+0x1d8/0x464
> kthread+0x178/0x238
> ret_from_fork+0x10/0x20
> Code: aa0003e8 91000429 f100044a 3940002b (3800150b)
> ---[ end trace 0fe00bec2b975c99 ]---
> Kernel panic - not syncing: Oops: Fatal exception in interrupt.
> 
Missing Fixes and Stable tag.

--srini
> Signed-off-by: Visweswara Tanuku <quic_vtanuku@...cinc.com>
> ---
>   drivers/slimbus/messaging.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
> index 242570a5e565..455c1fd1490f 100644
> --- a/drivers/slimbus/messaging.c
> +++ b/drivers/slimbus/messaging.c
> @@ -148,8 +148,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
>   	}
>   
>   	ret = ctrl->xfer_msg(ctrl, txn);
> -
> -	if (!ret && need_tid && !txn->msg->comp) {
> +	if (ret == -ETIMEDOUT) {
> +		slim_free_txn_tid(ctrl, txn);
> +	} else if (!ret && need_tid && !txn->msg->comp) {
>   		unsigned long ms = txn->rl + HZ;
>   
>   		time_left = wait_for_completion_timeout(txn->comp,