linux-kernel - Re: [PATCH] ipmi: ssif_bmc: Move smbus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c92cab21-ca41-4f34-b507-e773c463d82f@os.amperecomputing.com>
Date: Fri, 3 Jan 2025 10:44:46 +0700
From: Quan Nguyen <quan@...amperecomputing.com>
To: Cosmo Chou <chou.cosmo@...il.com>
Cc: openipmi-developer@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
 cosmo.chou@...ntatw.com, potin.lai@...ntatw.com, minyard@....org
Subject: Re: [PATCH] ipmi: ssif_bmc: Move smbus_cmd assignment after cleanup



On 01/01/2025 23:54, Cosmo Chou wrote:
> Move smbus_cmd assignment to the end of process_smbus_cmd() to ensure
> the new command is not lost when complete_response() is triggered.
> 

Thanks Cosmo for the catch.

And, IMHO, the root cause is the memset() on part buffer called in 
complete_response() is not quite correct. In the current implementation, 
the complete_response() should only be called when the READ is 
completed, ie: only on I2C_SLAVE_STOP of READ transaction, otherwise all 
the info of current on-going request will be mistakenly cleared as in 
this case.

This patch is good and I wonder if we can make this a bit further as below?

diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c
index a14fafc583d4..310f17dd9511 100644
--- a/drivers/char/ipmi/ssif_bmc.c
+++ b/drivers/char/ipmi/ssif_bmc.c
@@ -292,7 +292,6 @@ static void complete_response(struct ssif_bmc_ctx 
*ssif_bmc)
         ssif_bmc->nbytes_processed = 0;
         ssif_bmc->remain_len = 0;
         ssif_bmc->busy = false;
-       memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer));
         wake_up_all(&ssif_bmc->wait_queue);
  }

@@ -744,9 +743,11 @@ static void on_stop_event(struct ssif_bmc_ctx 
*ssif_bmc, u8 *val)
                         ssif_bmc->aborting = true;
                 }
         } else if (ssif_bmc->state == SSIF_RES_SENDING) {
-               if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num 
== 0xFF)
+               if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num 
== 0xFF) {
+                       memset(&ssif_bmc->part_buf, 0, sizeof(struct 
ssif_part_buffer));
                         /* Invalidate response buffer to denote it is 
sent */
                         complete_response(ssif_bmc);
+               }
                 ssif_bmc->state = SSIF_READY;
         }

Thanks and Happy New Year.
- Quan