From patchwork Wed Dec 21 16:40:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 35430 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:e747:0:0:0:0:0 with SMTP id c7csp3624518wrn; Wed, 21 Dec 2022 08:41:25 -0800 (PST) X-Google-Smtp-Source: AMrXdXsQsBndcUk+x/+2BOFq5dUodKphEIu+U8dkVIAT1YdiNNR4xXPurvE/3qexCgHhFFsh8fz7 X-Received: by 2002:a05:6402:1caa:b0:46c:2c94:d30a with SMTP id cz10-20020a0564021caa00b0046c2c94d30amr2061910edb.31.1671640885032; Wed, 21 Dec 2022 08:41:25 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671640885; cv=none; d=google.com; s=arc-20160816; b=gveHCAa4VREbbyusRp3sW9SfllVzH4jgCMob2S/kBojk7xrkac//3LkPlTc9r0rRUz xmGSjCE4vVQkHYKjAIECjZEBlXagHPGEximM624vIU4M7KVPLfSxRhY7EZVX/1FAaxP5 +oEN0mn05ufoGQXxtT5+VmZS98rBmOdLn4cjEhKfTKPVeB5ghYkoQSmukS2ZsTgQIks2 AwB/NHWnS4ZoKq/J4KjMG/3Y1p6BHu8oZP/+I/FSbdBfqFQ7lUk4FbLA5+pyOMsS+QqP bZvi/emb1q/Y5w+nKn0vcME365i3IPKr1bXoLqyvo8PAnbhDeEziPsqGbYHdfRLTano6 Vq0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=jeLzGgpWvlXIHM7/m1+VkREz/loKw56kOMYwg3dbCR8=; b=qq1MnxVxEC4zXGDlH1v8RUkodyEHGRpjHrUOHEKHkImPPFXevqdhol9dJ21HhYvlUk eQMxh+03aOW6zGPCdrJbrxQ8D5jxvO1YlfnSVo5Wv8JzR+2Q+M6bkS8N7K5iXOCMx6VY SrllbqigLm7kJKA/H+hZruUSTq6x1ENRiGySrR32nFtL8F8Zm269tXtjae6O1hRVOeUb 4tyw/9OxsMy7K2KzZQG3lPcR8Mg8e68p++DPXDavczh9OyqWHXT5TJXTwjnDwKDWiReb iEGbnZLXChvF/8vL1zQcWhTyJvAwJDiphHFQIiRG2rgh9F2W3xxcPSZaQ8IJBpckh/lr mlfw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=A1IZ8NXd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id wz11-20020a170906fe4b00b007c4f4d0427dsi14216642ejb.409.2022.12.21.08.41.02; Wed, 21 Dec 2022 08:41:25 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=A1IZ8NXd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234627AbiLUQkb (ORCPT + 99 others); Wed, 21 Dec 2022 11:40:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37144 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234073AbiLUQk3 (ORCPT ); Wed, 21 Dec 2022 11:40:29 -0500 Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BAE0220F4 for ; Wed, 21 Dec 2022 08:40:28 -0800 (PST) Received: by mail-lj1-x22e.google.com with SMTP id v11so16174588ljk.12 for ; Wed, 21 Dec 2022 08:40:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=jeLzGgpWvlXIHM7/m1+VkREz/loKw56kOMYwg3dbCR8=; b=A1IZ8NXd4JXsD4fefE0ROucxsbJwAlJc7/L72mU3MDoFLX4summ4UIsA2viSJDN46N r89qzqe/2ZudNnaLcHyMHlhbH0xLE9Y2KZ9flgx0Sfmwu/5vxO7Q8lkPzk+a729vDeG8 jtGDVissye9KuoLBi3fZDGBu+dmTHgMBPq8VHKJNqTvd6QM3/8uLF2gWUYm28zJjGqRK 9l/xmgATZYg6R1BwoT/z9lIMDmUhX08zlvpXnqhcZoWbhfD1oy6Lx0n/YnXNyBIADd6S Ph4q6RFGaFxooLclz0oJaXoZo+Yv+sm4nzjfRyBd18TM/+5smAQ3laX8esMqHP83Zrrd FzCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=jeLzGgpWvlXIHM7/m1+VkREz/loKw56kOMYwg3dbCR8=; b=WDOIRVSzS+D5hX9lRuIGIX4XeKIZxOuP60NCC5449ODziD7YXICR3uvzKPznfNlKvy 6qSD/dQ+cYetRpG6EsD0sV6OCoCLmL5z5BlDoZSDv7O0KEK5VKS9CkcM5ptcqEezudYP hTCEdOsDTlJWc7CKp7wmj4Crqy9sfjaDHJWnh+fY8kVqxx7xkGZ2MGhwYobbNdZt9y8a szMZabS4+DdP3w0VYgEaVMIp67I9btU605CcCCxmh7CdL6IiR1LEC4mzHDIRJ+Pk1KOz fonmxwagksH6ctqwI0h8HN5jdIgE9UueWYxniAK78yRzxN4WTzsYAlw/nga5cJcFdAKH pEkw== X-Gm-Message-State: AFqh2kpU0ZO98H7+3AsRtXrCrb5tMsepXKcZq9ErhiMQoEzQ0YYoMEdq Tluy0D23N/fH3cMmemBkMpBK7Q== X-Received: by 2002:a2e:b5c4:0:b0:277:81a3:f6e0 with SMTP id g4-20020a2eb5c4000000b0027781a3f6e0mr748087ljn.19.1671640826498; Wed, 21 Dec 2022 08:40:26 -0800 (PST) Received: from krzk-bin.NAT.warszawa.vectranet.pl (088156142067.dynamic-2-waw-k-3-2-0.vectranet.pl. [88.156.142.67]) by smtp.gmail.com with ESMTPSA id p5-20020a2eb985000000b0027a00aab48fsm1331889ljp.66.2022.12.21.08.40.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Dec 2022 08:40:26 -0800 (PST) From: Krzysztof Kozlowski To: Andy Gross , Bjorn Andersson , Konrad Dybcio , Greg Kroah-Hartman , Jiri Slaby , Satya Priya , linux-arm-msm@vger.kernel.org, linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Krzysztof Kozlowski , stable@vger.kernel.org Subject: [PATCH v2] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Date: Wed, 21 Dec 2022 17:40:22 +0100 Message-Id: <20221221164022.1087814-1-krzysztof.kozlowski@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752751667958560804?= X-GMAIL-MSGID: =?utf-8?q?1752842512521531612?= Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer. Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Jiri Slaby --- Changes since v1: 1. Rename the function (Jiri) --- drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c index b487823f0e61..49b9ffeae676 100644 --- a/drivers/tty/serial/qcom_geni_serial.c +++ b/drivers/tty/serial/qcom_geni_serial.c @@ -864,9 +864,10 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev) return IRQ_HANDLED; } -static void get_tx_fifo_size(struct qcom_geni_serial_port *port) +static int setup_fifos(struct qcom_geni_serial_port *port) { struct uart_port *uport; + u32 old_rx_fifo_depth = port->rx_fifo_depth; uport = &port->uport; port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se); @@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port) port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se); uport->fifosize = (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE; + + if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) { + port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo, + port->rx_fifo_depth * sizeof(u32), + GFP_KERNEL); + if (!port->rx_fifo) + return -ENOMEM; + } + + return 0; } @@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport) u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT; u32 proto; u32 pin_swap; + int ret; proto = geni_se_read_proto(&port->se); if (proto != GENI_SE_UART) { @@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport) qcom_geni_serial_stop_rx(uport); - get_tx_fifo_size(port); + ret = setup_fifos(port); + if (ret) + return ret; writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT);