linux-kernel - Re: [PATCH v3] bus: mhi: ep: Fix chained transfer handling in read path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <175767376186.19386.3016025814511034609.b4-ty@oss.qualcomm.com>
Date: Fri, 12 Sep 2025 16:12:41 +0530
From: Manivannan Sadhasivam <manivannan.sadhasivam@....qualcomm.com>
To: Manivannan Sadhasivam <mani@...nel.org>, Alex Elder <elder@...nel.org>, 
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
 Sumit Kumar <sumit.kumar@....qualcomm.com>
Cc: mhi@...ts.linux.dev, linux-arm-msm@...r.kernel.org, 
 linux-kernel@...r.kernel.org, quic_krichai@...cinc.com, 
 quic_akhvin@...cinc.com, quic_skananth@...cinc.com, 
 quic_vbadigan@...cinc.com, stable@...r.kernel.org, 
 Akhil Vinod <akhil.vinod@....qualcomm.com>
Subject: Re: [PATCH v3] bus: mhi: ep: Fix chained transfer handling in read
 path


On Wed, 10 Sep 2025 18:11:09 +0530, Sumit Kumar wrote:
> The mhi_ep_read_channel function incorrectly assumes the End of Transfer
> (EOT) bit is received with the doorbell in chained transactions, causing
> it to advance mhi_chan->rd_offset beyond wr_offset during host-to-device
> transfers when EOT has not yet arrived, leading to access of unmapped host
> memory that causes IOMMU faults and processing of stale TREs.
> 
> Modify the loop condition to ensure mhi_queue is not empty, allowing the
> function to process only valid TREs up to the current write pointer to
> prevent premature reads and ensure safe traversal of chained TREs.
> Remove buf_left from the while loop condition to avoid exiting prematurely
> before reading the ring completely, and remove write_offset since it will
> always be zero because the new cache buffer is allocated every time.
> 
> [...]

Applied, thanks!

[1/1] bus: mhi: ep: Fix chained transfer handling in read path
      commit: f5225a34bd8f9f64eec37f6ae1461289aaa3eb86

Best regards,
-- 
Manivannan Sadhasivam <manivannan.sadhasivam@....qualcomm.com>