linux-kernel - [PATCH] bus: mhi: ep: Fix chained transfer handling in read path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250709-chained_transfer-v1-1-2326a4605c9c@quicinc.com>
Date: Wed, 9 Jul 2025 16:03:17 +0530
From: Sumit Kumar <quic_sumk@...cinc.com>
To: Manivannan Sadhasivam <mani@...nel.org>, Alex Elder <elder@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC: <mhi@...ts.linux.dev>, <linux-arm-msm@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <quic_krichai@...cinc.com>,
        <quic_akhvin@...cinc.com>, <quic_skananth@...cinc.com>,
        <quic_vbadigan@...cinc.com>, Sumit Kumar <sumk@....qualcomm.com>,
        <stable@...r.kernel.org>, Akhil Vinod <akhvin@....qualcomm.com>
Subject: [PATCH] bus: mhi: ep: Fix chained transfer handling in read path

From: Sumit Kumar <sumk@....qualcomm.com>

The current implementation of mhi_ep_read_channel, in case of chained
transactions, assumes the End of Transfer(EOT) bit is received with the
doorbell. As a result, it may incorrectly advance mhi_chan->rd_offset
beyond wr_offset during host-to-device transfers when EOT has not yet
arrived. This can lead to access of unmapped host memory, causing
IOMMU faults and processing of stale TREs.

This change modifies the loop condition to ensure rd_offset remains behind
wr_offset, allowing the function to process only valid TREs up to the
current write pointer. This prevents premature reads and ensures safe
traversal of chained TREs.

Fixes: 5301258899773 ("bus: mhi: ep: Add support for reading from the host")
Cc: stable@...r.kernel.org
Co-developed-by: Akhil Vinod <akhvin@....qualcomm.com>
Signed-off-by: Akhil Vinod <akhvin@....qualcomm.com>
Signed-off-by: Sumit Kumar <sumk@....qualcomm.com>
---
 drivers/bus/mhi/ep/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
index b3eafcf2a2c50d95e3efd3afb27038ecf55552a5..2e134f44952d1070c62c24aeca9effc7fd325860 100644
--- a/drivers/bus/mhi/ep/main.c
+++ b/drivers/bus/mhi/ep/main.c
@@ -468,7 +468,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
 
 			mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size;
 		}
-	} while (buf_left && !tr_done);
+	} while (buf_left && !tr_done && mhi_chan->rd_offset != ring->wr_offset);
 
 	return 0;
 

---
base-commit: 4c06e63b92038fadb566b652ec3ec04e228931e8
change-id: 20250709-chained_transfer-0b95f8afa487

Best regards,
-- 
Sumit Kumar <quic_sumk@...cinc.com>