linux-kernel - Re: [PATCH 2/7] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6f01162ca2024c8bc4f22e0be2f33e8724238f80.camel@codeconstruct.com.au>
Date: Thu, 17 Apr 2025 09:03:45 +0930
From: Andrew Jeffery <andrew@...econstruct.com.au>
To: Jean Delvare <jdelvare@...e.de>
Cc: Joel Stanley <joel@....id.au>, Henry Martin <bsdhenrymartin@...il.com>, 
 Patrick Rudolph <patrick.rudolph@...ements.com>, Andrew Geissler
 <geissonator@...oo.com>, Ninad Palsule <ninad@...ux.ibm.com>, Patrick
 Venture <venture@...gle.com>, Robert Lippert <roblip@...il.com>,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH 2/7] soc: aspeed: lpc-snoop: Don't disable channels that
 aren't enabled

On Wed, 2025-04-16 at 14:15 +0200, Jean Delvare wrote:
> On Fri, 11 Apr 2025 10:38:32 +0930, Andrew Jeffery wrote:
> > Mitigate e.g. the following:
> > 
> >     # echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-
> > lpc-snoop/unbind
> >     ...
> >     [  120.363594] Unable to handle kernel NULL pointer dereference
> > at virtual address 00000004 when write
> >     [  120.373866] [00000004] *pgd=00000000
> >     [  120.377910] Internal error: Oops: 805 [#1] SMP ARM
> >     [  120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted
> > 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE
> >     ...
> >     [  120.679543] Call trace:
> >     [  120.679559]  misc_deregister from
> > aspeed_lpc_snoop_remove+0x84/0xac
> >     [  120.692462]  aspeed_lpc_snoop_remove from
> > platform_remove+0x28/0x38
> >     [  120.700996]  platform_remove from
> > device_release_driver_internal+0x188/0x200
> >     ...
> > 
> > Fixes: 9f4f9ae81d0a ("drivers/misc: add Aspeed LPC snoop driver")
> > Cc: stable@...r.kernel.org
> > Cc: Jean Delvare <jdelvare@...e.de>
> > Signed-off-by: Andrew Jeffery <andrew@...econstruct.com.au>
> > ---
> >  drivers/soc/aspeed/aspeed-lpc-snoop.c | 11 +++++++++++
> >  1 file changed, 11 insertions(+)
> > 
> > diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c
> > b/drivers/soc/aspeed/aspeed-lpc-snoop.c
> > index
> > bfa770ec51a889260d11c26e675f3320bf710a54..e9d9a8e60a6f062c0b53c9c02
> > e5d73768453998d 100644
> > --- a/drivers/soc/aspeed/aspeed-lpc-snoop.c
> > +++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c
> > @@ -58,6 +58,7 @@ struct aspeed_lpc_snoop_model_data {
> >  };
> >  
> >  struct aspeed_lpc_snoop_channel {
> > +       bool enabled;
> >         struct kfifo            fifo;
> >         wait_queue_head_t       wq;
> >         struct miscdevice       miscdev;
> > @@ -190,6 +191,9 @@ static int aspeed_lpc_enable_snoop(struct
> > aspeed_lpc_snoop *lpc_snoop,
> >         const struct aspeed_lpc_snoop_model_data *model_data =
> >                 of_device_get_match_data(dev);
> >  
> > +       if (lpc_snoop->chan[channel].enabled)
> > +               return -EBUSY;
> 
> This isn't supposed to happen, right? 

No, not supposed to happen.

> WARN_ON() may be appropriate.

Ack.

> 
> > +
> >         init_waitqueue_head(&lpc_snoop->chan[channel].wq);
> >         /* Create FIFO datastructure */
> >         rc = kfifo_alloc(&lpc_snoop->chan[channel].fifo,
> > @@ -236,6 +240,8 @@ static int aspeed_lpc_enable_snoop(struct
> > aspeed_lpc_snoop *lpc_snoop,
> >                 regmap_update_bits(lpc_snoop->regmap, HICRB,
> >                                 hicrb_en, hicrb_en);
> >  
> > +       lpc_snoop->chan[channel].enabled = true;
> > +
> >         return 0;
> >  
> >  err_misc_deregister:
> > @@ -248,6 +254,9 @@ static int aspeed_lpc_enable_snoop(struct
> > aspeed_lpc_snoop *lpc_snoop,
> >  static void aspeed_lpc_disable_snoop(struct aspeed_lpc_snoop
> > *lpc_snoop,
> >                                      int channel)
> >  {
> > +       if (!lpc_snoop->chan[channel].enabled)
> > +               return;
> > +
> >         switch (channel) {
> >         case 0:
> >                 regmap_update_bits(lpc_snoop->regmap, HICR5,
> > @@ -263,6 +272,8 @@ static void aspeed_lpc_disable_snoop(struct
> > aspeed_lpc_snoop *lpc_snoop,
> >                 return;
> >         }
> >  
> > +       lpc_snoop->chan[channel].enabled = false;
> > +       /* Consider improving safety wrt concurrent reader(s) */
> >         misc_deregister(&lpc_snoop->chan[channel].miscdev);
> >         kfifo_free(&lpc_snoop->chan[channel].fifo);
> >  }
> > 
> 
> Acked-by: Jean Delvare <jdelvare@...e.de>
> 

Thanks,

Andrew