linux-kernel - Re: [PATCH] bus: mhi: ep: Fix chained transfer handling in read path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <989518a6-5626-4724-a9e9-eadc081f5d67@quicinc.com>
Date: Wed, 16 Jul 2025 11:07:14 +0530
From: Krishna Chaitanya Chundru <quic_krichai@...cinc.com>
To: Sumit Kumar <quic_sumk@...cinc.com>,
        Manivannan Sadhasivam
	<mani@...nel.org>,
        Alex Elder <elder@...nel.org>,
        Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>
CC: <mhi@...ts.linux.dev>, <linux-arm-msm@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <quic_akhvin@...cinc.com>,
        <quic_skananth@...cinc.com>, <quic_vbadigan@...cinc.com>,
        Sumit Kumar
	<sumk@....qualcomm.com>, <stable@...r.kernel.org>,
        Akhil Vinod
	<akhvin@....qualcomm.com>
Subject: Re: [PATCH] bus: mhi: ep: Fix chained transfer handling in read path



On 7/9/2025 4:03 PM, Sumit Kumar wrote:
> From: Sumit Kumar <sumk@....qualcomm.com>
> 
> The current implementation of mhi_ep_read_channel, in case of chained
> transactions, assumes the End of Transfer(EOT) bit is received with the
> doorbell. As a result, it may incorrectly advance mhi_chan->rd_offset
> beyond wr_offset during host-to-device transfers when EOT has not yet
> arrived. This can lead to access of unmapped host memory, causing
> IOMMU faults and processing of stale TREs.
> 
> This change modifies the loop condition to ensure rd_offset remains behind
> wr_offset, allowing the function to process only valid TREs up to the
> current write pointer. This prevents premature reads and ensures safe
> traversal of chained TREs.
> 
> Fixes: 5301258899773 ("bus: mhi: ep: Add support for reading from the host")
> Cc: stable@...r.kernel.org
> Co-developed-by: Akhil Vinod <akhvin@....qualcomm.com>
> Signed-off-by: Akhil Vinod <akhvin@....qualcomm.com>
> Signed-off-by: Sumit Kumar <sumk@....qualcomm.com>
Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@....qualcomm.com>
> ---
>   drivers/bus/mhi/ep/main.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
> index b3eafcf2a2c50d95e3efd3afb27038ecf55552a5..2e134f44952d1070c62c24aeca9effc7fd325860 100644
> --- a/drivers/bus/mhi/ep/main.c
> +++ b/drivers/bus/mhi/ep/main.c
> @@ -468,7 +468,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
>   
>   			mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size;
>   		}
> -	} while (buf_left && !tr_done);
> +	} while (buf_left && !tr_done && mhi_chan->rd_offset != ring->wr_offset);
>   
>   	return 0;
>   
> 
> ---
> base-commit: 4c06e63b92038fadb566b652ec3ec04e228931e8
> change-id: 20250709-chained_transfer-0b95f8afa487
> 
> Best regards,