| Message ID | 20210525170336.213a19b4@endymion |
|---|---|
| State | Accepted |
| Commit | e4d8716c3dcec47f1557024add24e1f3c09eb24b |
| Headers | show |
| Series | i2c: i801: Don't generate an interrupt on bus reset | expand |
On Tue, May 25, 2021 at 05:03:36PM +0200, Jean Delvare wrote: > Now that the i2c-i801 driver supports interrupts, setting the KILL bit > in a attempt to recover from a timed out transaction triggers an > interrupt. Unfortunately, the interrupt handler (i801_isr) is not > prepared for this situation and will try to process the interrupt as > if it was signaling the end of a successful transaction. In the case > of a block transaction, this can result in an out-of-range memory > access. > > This condition was reproduced several times by syzbot: > https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e > https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e > https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e > https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb > https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a > https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 > > So disable interrupts while trying to reset the bus. Interrupts will > be enabled again for the following transaction. > > Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions") > Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com > Signed-off-by: Jean Delvare <jdelvare@suse.de> > Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com> Applied to for-current, thanks!
--- linux-5.12.orig/drivers/i2c/busses/i2c-i801.c 2021-05-24 12:00:59.307576983 +0200 +++ linux-5.12/drivers/i2c/busses/i2c-i801.c 2021-05-24 12:04:10.230998259 +0200 @@ -401,11 +401,9 @@ static int i801_check_post(struct i801_p dev_err(&priv->pci_dev->dev, "Transaction timeout\n"); /* try to stop the current command */ dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n"); - outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL, - SMBHSTCNT(priv)); + outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv)); usleep_range(1000, 2000); - outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL), - SMBHSTCNT(priv)); + outb_p(0, SMBHSTCNT(priv)); /* Check if it worked */ status = inb_p(SMBHSTSTS(priv));
Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling the end of a successful transaction. In the case of a block transaction, this can result in an out-of-range memory access. This condition was reproduced several times by syzbot: https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 So disable interrupts while trying to reset the bus. Interrupts will be enabled again for the following transaction. Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions") Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com Signed-off-by: Jean Delvare <jdelvare@suse.de> Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com> --- drivers/i2c/busses/i2c-i801.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)