linux-kernel - Re: [PATCH] bus: mhi: ep: Fix chained transfer handling in read path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5aqtqicbtlkrqbiw2ba7kkgwrmsuqx2kjukh2tavfihm5hq5ry@gdeqegayfh77>
Date: Wed, 16 Jul 2025 12:10:33 +0530
From: Manivannan Sadhasivam <mani@...nel.org>
To: Sumit Kumar <quic_sumk@...cinc.com>
Cc: Alex Elder <elder@...nel.org>, 
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>, mhi@...ts.linux.dev, linux-arm-msm@...r.kernel.org, 
	linux-kernel@...r.kernel.org, quic_krichai@...cinc.com, quic_akhvin@...cinc.com, 
	quic_skananth@...cinc.com, quic_vbadigan@...cinc.com, Sumit Kumar <sumk@....qualcomm.com>, 
	stable@...r.kernel.org, Akhil Vinod <akhvin@....qualcomm.com>
Subject: Re: [PATCH] bus: mhi: ep: Fix chained transfer handling in read path

On Wed, Jul 09, 2025 at 04:03:17PM GMT, Sumit Kumar wrote:
> From: Sumit Kumar <sumk@....qualcomm.com>
> 
> The current implementation of mhi_ep_read_channel, in case of chained
> transactions, assumes the End of Transfer(EOT) bit is received with the
> doorbell. As a result, it may incorrectly advance mhi_chan->rd_offset
> beyond wr_offset during host-to-device transfers when EOT has not yet
> arrived. This can lead to access of unmapped host memory, causing
> IOMMU faults and processing of stale TREs.
> 
> This change modifies the loop condition to ensure rd_offset remains behind
> wr_offset, allowing the function to process only valid TREs up to the
> current write pointer. This prevents premature reads and ensures safe
> traversal of chained TREs.
> 
> Fixes: 5301258899773 ("bus: mhi: ep: Add support for reading from the host")
> Cc: stable@...r.kernel.org
> Co-developed-by: Akhil Vinod <akhvin@....qualcomm.com>
> Signed-off-by: Akhil Vinod <akhvin@....qualcomm.com>
> Signed-off-by: Sumit Kumar <sumk@....qualcomm.com>
> ---
>  drivers/bus/mhi/ep/main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
> index b3eafcf2a2c50d95e3efd3afb27038ecf55552a5..2e134f44952d1070c62c24aeca9effc7fd325860 100644
> --- a/drivers/bus/mhi/ep/main.c
> +++ b/drivers/bus/mhi/ep/main.c
> @@ -468,7 +468,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
>  
>  			mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size;
>  		}
> -	} while (buf_left && !tr_done);
> +	} while (buf_left && !tr_done && mhi_chan->rd_offset != ring->wr_offset);

You should use mhi_ep_queue_is_empty() for checking the available elements to
process. And with this check in place, the existing check in
mhi_ep_process_ch_ring() becomes redundant.

- Mani

-- 
மணிவண்ணன் சதாசிவம்