The SMBus block read path trusts the device-provided count byte and
copies that many bytes from the master buffer:
buf[0] = readb(p3);
read_count = buf[0];
memcpy_fromio(&buf[1], p3 + 1, read_count);
Without validating 'read_count', a malicious or misbehaving device can
cause an out-of-bounds write to the caller's buffer and may also trigger
out-of-range MMIO reads beyond the controller's buffer window.
SMBus Block Read returns up to 32 data bytes as per the kernel
documentation, so clamp the length to [1, I2C_SMBUS_BLOCK_MAX], verify
the caller's buffer has at least 'read_count + 1' bytes available, and
defensively ensure it does not exceed the controller buffer. Also break
out of the chunking loop after a successful SMBus read.
Return -EPROTO for invalid counts and -EMSGSIZE when the provided buffer
is too small.
Fixes: 361693697249 ("i2c: microchip: pci1xxxx: Add driver for I2C host controller in multifunction endpoint of pci1xxxx switch")
Cc: stable(a)vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com>
---
drivers/i2c/busses/i2c-mchp-pci1xxxx.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-mchp-pci1xxxx.c b/drivers/i2c/busses/i2c-mchp-pci1xxxx.c
index 5ef136c3ecb1..2307c8ec2dc7 100644
--- a/drivers/i2c/busses/i2c-mchp-pci1xxxx.c
+++ b/drivers/i2c/busses/i2c-mchp-pci1xxxx.c
@@ -880,7 +880,22 @@ static int pci1xxxx_i2c_read(struct pci1xxxx_i2c *i2c, u8 slaveaddr,
}
if (i2c->flags & I2C_FLAGS_SMB_BLK_READ) {
- buf[0] = readb(p3);
+ u8 cnt = readb(p3);
+
+ if (!cnt || cnt > I2C_SMBUS_BLOCK_MAX) {
+ retval = -EPROTO;
+ goto cleanup;
+ }
+ if (cnt > total_len - 1) {
+ retval = -EMSGSIZE;
+ goto cleanup;
+ }
+ if (cnt > (SMBUS_BUF_MAX_SIZE - 1)) {
+ retval = -EOVERFLOW;
+ goto cleanup;
+ }
+
+ buf[0] = cnt;
read_count = buf[0];
memcpy_fromio(&buf[1], p3 + 1, read_count);
} else {
--
2.43.0
The pmsr_lock spinlock used to be necessary to synchronize access to the
PMSR register, because that access could have been triggered from either
config space access in rcar_pcie_config_access() or an exception handler
rcar_pcie_aarch32_abort_handler().
The rcar_pcie_aarch32_abort_handler() case is no longer applicable since
commit 6e36203bc14c ("PCI: rcar: Use PCI_SET_ERROR_RESPONSE after read
which triggered an exception"), which performs more accurate, controlled
invocation of the exception, and a fixup.
This leaves rcar_pcie_config_access() as the only call site from which
rcar_pcie_wakeup() is called. The rcar_pcie_config_access() can only be
called from the controller struct pci_ops .read and .write callbacks,
and those are serialized in drivers/pci/access.c using raw spinlock
'pci_lock' . CONFIG_PCI_LOCKLESS_CONFIG is never set on this platform.
Since the 'pci_lock' is a raw spinlock , and the 'pmsr_lock' is not a
raw spinlock, this constellation triggers 'BUG: Invalid wait context'
with CONFIG_PROVE_RAW_LOCK_NESTING=y .
Remove the pmsr_lock to fix the locking.
Fixes: a115b1bd3af0 ("PCI: rcar: Add L1 link state fix into data abort hook")
Reported-by: Duy Nguyen <duy.nguyen.rh(a)renesas.com>
Reported-by: Thuan Nguyen <thuan.nguyen-hong(a)banvien.com.vn>
Cc: stable(a)vger.kernel.org
Signed-off-by: Marek Vasut <marek.vasut+renesas(a)mailbox.org>
---
=============================
[ BUG: Invalid wait context ]
6.17.0-rc4-next-20250905-00048-ga08e553145e7-dirty #1116 Not tainted
-----------------------------
swapper/0/1 is trying to lock:
ffffffd92cf69c30 (pmsr_lock){....}-{3:3}, at: rcar_pcie_config_access+0x48/0x260
other info that might help us debug this:
context-{5:5}
3 locks held by swapper/0/1:
#0: ffffff84c0f890f8 (&dev->mutex){....}-{4:4}, at: device_lock+0x14/0x1c
#1: ffffffd92cf675b0 (pci_rescan_remove_lock){+.+.}-{4:4}, at: pci_lock_rescan_remove+0x18/0x20
#2: ffffffd92cf674a0 (pci_lock){....}-{2:2}, at: pci_bus_read_config_dword+0x54/0xd8
stack backtrace:
CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc4-next-20250905-00048-ga08e553145e7-dirty #1116 PREEMPT
Hardware name: Renesas Salvator-X 2nd version board based on r8a77951 (DT)
Call trace:
dump_backtrace+0x6c/0x7c (C)
show_stack+0x14/0x1c
dump_stack_lvl+0x68/0x8c
dump_stack+0x14/0x1c
__lock_acquire+0x3e8/0x1064
lock_acquire+0x17c/0x2ac
_raw_spin_lock_irqsave+0x54/0x70
rcar_pcie_config_access+0x48/0x260
rcar_pcie_read_conf+0x44/0xd8
pci_bus_read_config_dword+0x78/0xd8
pci_bus_generic_read_dev_vendor_id+0x30/0x138
pci_bus_read_dev_vendor_id+0x60/0x68
pci_scan_single_device+0x11c/0x1ec
pci_scan_slot+0x7c/0x170
pci_scan_child_bus_extend+0x5c/0x29c
pci_scan_child_bus+0x10/0x18
pci_scan_root_bus_bridge+0x90/0xc8
pci_host_probe+0x24/0xc4
rcar_pcie_probe+0x5e8/0x650
platform_probe+0x58/0x88
really_probe+0x190/0x350
__driver_probe_device+0x120/0x138
driver_probe_device+0x38/0xec
__driver_attach+0x158/0x168
bus_for_each_dev+0x7c/0xd0
driver_attach+0x20/0x28
bus_add_driver+0xe0/0x1d8
driver_register+0xac/0xe8
__platform_driver_register+0x1c/0x24
rcar_pcie_driver_init+0x18/0x20
do_one_initcall+0xd4/0x220
kernel_init_freeable+0x308/0x30c
kernel_init+0x20/0x11c
ret_from_fork+0x10/0x20
---
Cc: "Krzysztof Wilczyński" <kwilczynski(a)kernel.org>
Cc: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: Geert Uytterhoeven <geert+renesas(a)glider.be>
Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org>
Cc: Magnus Damm <magnus.damm(a)gmail.com>
Cc: Manivannan Sadhasivam <mani(a)kernel.org>
Cc: Marc Zyngier <maz(a)kernel.org>
Cc: Rob Herring <robh(a)kernel.org>
Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Cc: linux-pci(a)vger.kernel.org
Cc: linux-renesas-soc(a)vger.kernel.org
---
drivers/pci/controller/pcie-rcar-host.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
index 4780e0109e583..625a00f3b2230 100644
--- a/drivers/pci/controller/pcie-rcar-host.c
+++ b/drivers/pci/controller/pcie-rcar-host.c
@@ -52,20 +52,13 @@ struct rcar_pcie_host {
int (*phy_init_fn)(struct rcar_pcie_host *host);
};
-static DEFINE_SPINLOCK(pmsr_lock);
-
static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base)
{
- unsigned long flags;
u32 pmsr, val;
int ret = 0;
- spin_lock_irqsave(&pmsr_lock, flags);
-
- if (!pcie_base || pm_runtime_suspended(pcie_dev)) {
- ret = -EINVAL;
- goto unlock_exit;
- }
+ if (!pcie_base || pm_runtime_suspended(pcie_dev))
+ return -EINVAL;
pmsr = readl(pcie_base + PMSR);
@@ -87,8 +80,6 @@ static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base)
writel(L1FAEG | PMEL1RX, pcie_base + PMSR);
}
-unlock_exit:
- spin_unlock_irqrestore(&pmsr_lock, flags);
return ret;
}
--
2.51.0
Make sure to drop the reference taken to the iommu platform device when
looking up its driver data during probe_device().
Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")
Cc: stable(a)vger.kernel.org # 4.8
Cc: Honghui Zhang <honghui.zhang(a)mediatek.com>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/iommu/mtk_iommu_v1.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 10cc0b1197e8..de9153c0a82f 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -435,6 +435,8 @@ static int mtk_iommu_v1_create_mapping(struct device *dev,
return -EINVAL;
dev_iommu_priv_set(dev, platform_get_drvdata(m4updev));
+
+ put_device(&m4updev->dev);
}
ret = iommu_fwspec_add_ids(dev, args->args, 1);
--
2.49.1
