| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID:
<VI1PR04MB1004979B7D38486FD1E1CC8508FDF2@VI1PR04MB10049.eurprd04.prod.outlook.com>
Date: Mon, 17 Mar 2025 15:46:52 +0000
From: Manjunatha Venkatesh <manjunatha.venkatesh@....com>
To: Frank Li <frank.li@....com>
CC: "miquel.raynal@...tlin.com" <miquel.raynal@...tlin.com>,
"conor.culhane@...vaco.com" <conor.culhane@...vaco.com>,
"alexandre.belloni@...tlin.com" <alexandre.belloni@...tlin.com>,
"linux-i3c@...ts.infradead.org" <linux-i3c@...ts.infradead.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"stable@...r.kernel.org" <stable@...r.kernel.org>, "rvmanjumce@...il.com"
<rvmanjumce@...il.com>
Subject: RE: [PATCH v4] svc-i3c-master: Fix read from unreadable memory at
svc_i3c_master_ibi_work()
> -----Original Message-----
> From: Frank Li <frank.li@....com>
> Sent: Monday, March 17, 2025 6:57 PM
> To: Manjunatha Venkatesh <manjunatha.venkatesh@....com>
> Cc: miquel.raynal@...tlin.com; conor.culhane@...vaco.com;
> alexandre.belloni@...tlin.com; linux-i3c@...ts.infradead.org; linux-
> kernel@...r.kernel.org; stable@...r.kernel.org; rvmanjumce@...il.com
> Subject: Re: [PATCH v4] svc-i3c-master: Fix read from unreadable memory at
> svc_i3c_master_ibi_work()
>
> On Thu, Mar 13, 2025 at 05:15:42AM +0000, Manjunatha Venkatesh wrote:
> >
> >
> > > -----Original Message-----
> > > From: Frank Li <frank.li@....com>
> > > Sent: Wednesday, March 12, 2025 11:59 PM
> > > To: Manjunatha Venkatesh <manjunatha.venkatesh@....com>
> > > Cc: miquel.raynal@...tlin.com; conor.culhane@...vaco.com;
> > > alexandre.belloni@...tlin.com; linux-i3c@...ts.infradead.org; linux-
> > > kernel@...r.kernel.org; stable@...r.kernel.org; rvmanjumce@...il.com
> > > Subject: Re: [PATCH v4] svc-i3c-master: Fix read from unreadable
> > > memory at
> > > svc_i3c_master_ibi_work()
> > >
> > > On Wed, Mar 12, 2025 at 07:23:56PM +0530, Manjunatha Venkatesh
> wrote:
> > > > As part of I3C driver probing sequence for particular device
> > > > instance, While adding to queue it is trying to access ibi
> > > > variable of dev which is not yet initialized causing "Unable to
> > > > handle kernel read from unreadable memory" resulting in kernel panic.
> > > >
> > > > Below is the sequence where this issue happened.
> > > > 1. During boot up sequence IBI is received at host from the slave device
> > > > before requesting for IBI, Usually will request IBI by calling
> > > > i3c_device_request_ibi() during probe of slave driver.
> > > > 2. Since master code trying to access IBI Variable for the particular
> > > > device instance before actually it initialized by slave driver,
> > > > due to this randomly accessing the address and causing kernel panic.
> > > > 3. i3c_device_request_ibi() function invoked by the slave driver where
> > > > dev->ibi = ibi; assigned as part of function call
> > > > i3c_dev_request_ibi_locked().
> > > > 4. But when IBI request sent by slave device, master code trying to
> access
> > > > this variable before its initialized due to this race condition
> > > > situation kernel panic happened.
> > > >
> > > > Fixes: dd3c52846d595 ("i3c: master: svc: Add Silvaco I3C master
> > > > driver")
> > > > Cc: stable@...r.kernel.org
> > > > Signed-off-by: Manjunatha Venkatesh
> <manjunatha.venkatesh@....com>
> > > > ---
> > > > Changes since v3:
> > > > - Description updated typo "Fixes:"
> > > >
> > > > drivers/i3c/master/svc-i3c-master.c | 7 +++++--
> > > > 1 file changed, 5 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/drivers/i3c/master/svc-i3c-master.c
> > > > b/drivers/i3c/master/svc-i3c-master.c
> > > > index d6057d8c7dec..98c4d2e5cd8d 100644
> > > > --- a/drivers/i3c/master/svc-i3c-master.c
> > > > +++ b/drivers/i3c/master/svc-i3c-master.c
> > > > @@ -534,8 +534,11 @@ static void svc_i3c_master_ibi_work(struct
> > > work_struct *work)
> > > > switch (ibitype) {
> > > > case SVC_I3C_MSTATUS_IBITYPE_IBI:
> > > > if (dev) {
> > > > - i3c_master_queue_ibi(dev, master->ibi.tbq_slot);
> > > > - master->ibi.tbq_slot = NULL;
> > > > + data = i3c_dev_get_master_data(dev);
> > > > + if (master->ibi.slots[data->ibi]) {
> > > > + i3c_master_queue_ibi(dev, master-
> > > >ibi.tbq_slot);
> > > > + master->ibi.tbq_slot = NULL;
> > > > + }
> > >
> > > You still not reply previous discussion:
> > >
> > > https://lore.kernel.org/linux-i3c/Z8sOKZSjHeeP2mY5@lizhi-Precision-T
> > > ower-
> > > 5810/T/#mfd02d6ddca0a4b57bc823dcbfa7571c564800417
> > >
> > [Manjunatha Venkatesh] : In the last mail answered to this question.
> >
> > > This is not issue only at svc driver, which should be common problem
> > > for other master controller drivers
> > >
> > [Manjunatha Venkatesh] :Yes, you are right.
> > One of my project I3C interface is required, where we have used IMX board
> as reference platform.
> > As part of boot sequence we come across this issue and tried to fix that
> particular controller driver.
> >
> > What is your conclusion on this? Is it not ok to take patch for SVC alone?
>
> I perfer fix at common framwork to avoid every driver copy the similar logic
> code.
>
[Manjunatha Venkatesh] : As per your suggestion tried the below patch at common framework api i3c_master_queue_ibi()
and looks working fine, didn't see any crash issue.
if (!dev->ibi || !slot) {
dev_warning("...");
return;
}
Will commit this change in next patch submission.
> Frank
>
> >
> > > Frank
> > >
> > > > }
> > > > svc_i3c_master_emit_stop(master);
> > > > break;
> > > > --
> > > > 2.46.1
> > > >
> >
> > --
> > linux-i3c mailing list
> > linux-i3c@...ts.infradead.org
> > http://lists.infradead.org/mailman/listinfo/linux-i3c
Powered by blists - more mailing lists