linux-kernel - Re: [PATCH] bus: mhi: ep: Update read pointer only after buffer is written

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <27642cab-9d0a-4989-9f3d-68f329676674@oss.qualcomm.com>
Date: Wed, 9 Apr 2025 08:41:03 -0600
From: Jeff Hugo <jeff.hugo@....qualcomm.com>
To: Sumit Kumar <quic_sumk@...cinc.com>,
        Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>,
        Alex Elder <elder@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: mhi@...ts.linux.dev, linux-arm-msm@...r.kernel.org,
        linux-kernel@...r.kernel.org, quic_krichai@...cinc.com,
        quic_akhvin@...cinc.com, quic_skananth@...cinc.com,
        quic_vbadigan@...cinc.com, stable@...r.kernel.org,
        Youssef Samir <quic_yabdulra@...cinc.com>
Subject: Re: [PATCH] bus: mhi: ep: Update read pointer only after buffer is
 written

On 4/9/2025 4:47 AM, Sumit Kumar wrote:
> Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated
> before the buffer is written, potentially causing race conditions where
> the host sees an updated read pointer before the buffer is actually
> written. Updating rd_offset prematurely can lead to the host accessing
> an uninitialized or incomplete element, resulting in data corruption.
> 
> Invoke the buffer write before updating rd_offset to ensure the element
> is fully written before signaling its availability.
> 
> Fixes: bbdcba57a1a2 ("bus: mhi: ep: Add support for ring management")
> cc: stable@...r.kernel.org
> Co-developed-by: Youssef Samir <quic_yabdulra@...cinc.com>
> Signed-off-by: Youssef Samir <quic_yabdulra@...cinc.com>
> Signed-off-by: Sumit Kumar <quic_sumk@...cinc.com>

Reviewed-by: Jeff Hugo <jeff.hugo@....qualcomm.com>