From patchwork Sun Jan 9 13:26:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heyi Guo X-Patchwork-Id: 1577696 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org (client-ip=2404:9400:2:0:216:3eff:fee1:b9f1; helo=lists.ozlabs.org; envelope-from=linux-aspeed-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org; receiver=) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2404:9400:2:0:216:3eff:fee1:b9f1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4JXH3R5SSxz9sRR for ; Mon, 10 Jan 2022 12:55:47 +1100 (AEDT) Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4JXH3R4T2Hz2xXd for ; Mon, 10 Jan 2022 12:55:47 +1100 (AEDT) X-Original-To: linux-aspeed@lists.ozlabs.org Delivered-To: linux-aspeed@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=linux.alibaba.com (client-ip=115.124.30.42; helo=out30-42.freemail.mail.aliyun.com; envelope-from=guoheyi@linux.alibaba.com; receiver=) X-Greylist: delayed 312 seconds by postgrey-1.36 at boromir; Mon, 10 Jan 2022 00:32:25 AEDT Received: from out30-42.freemail.mail.aliyun.com (out30-42.freemail.mail.aliyun.com [115.124.30.42]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4JWyYj3vVdz2xDv for ; Mon, 10 Jan 2022 00:32:24 +1100 (AEDT) X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R901e4; CH=green; DM=||false|; DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=e01e04407; MF=guoheyi@linux.alibaba.com; NM=1; PH=DS; RN=11; SR=0; TI=SMTPD_---0V1Il5dP_1641734775; Received: from fdadf40dcbca.tbsite.net(mailfrom:guoheyi@linux.alibaba.com fp:SMTPD_---0V1Il5dP_1641734775) by smtp.aliyun-inc.com(127.0.0.1); Sun, 09 Jan 2022 21:26:48 +0800 From: Heyi Guo To: linux-kernel@vger.kernel.org Subject: [PATCH] drivers/i2c-aspeed: avoid invalid memory reference after timeout Date: Sun, 9 Jan 2022 21:26:13 +0800 Message-Id: <20220109132613.122912-1-guoheyi@linux.alibaba.com> X-Mailer: git-send-email 2.17.1 X-Mailman-Approved-At: Mon, 10 Jan 2022 12:51:28 +1100 X-BeenThere: linux-aspeed@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux ASPEED SoC development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-aspeed@lists.ozlabs.org, openbmc@lists.ozlabs.org, Brendan Higgins , Philipp Zabel , linux-arm-kernel@lists.infradead.org, linux-i2c@vger.kernel.org Errors-To: linux-aspeed-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Linux-aspeed" The memory will be freed by the caller if transfer timeout occurs, then it would trigger kernel panic if the peer device responds with something after timeout and triggers the interrupt handler of aspeed i2c driver. Set the msgs pointer to NULL to avoid invalid memory reference after timeout to fix this potential kernel panic. Signed-off-by: Heyi Guo ------- Cc: Brendan Higgins Cc: Benjamin Herrenschmidt Cc: Joel Stanley Cc: Andrew Jeffery Cc: Philipp Zabel Cc: linux-i2c@vger.kernel.org Cc: openbmc@lists.ozlabs.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-aspeed@lists.ozlabs.org --- drivers/i2c/busses/i2c-aspeed.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c index 67e8b97c0c950..3ab0396168680 100644 --- a/drivers/i2c/busses/i2c-aspeed.c +++ b/drivers/i2c/busses/i2c-aspeed.c @@ -708,6 +708,11 @@ static int aspeed_i2c_master_xfer(struct i2c_adapter *adap, spin_lock_irqsave(&bus->lock, flags); if (bus->master_state == ASPEED_I2C_MASTER_PENDING) bus->master_state = ASPEED_I2C_MASTER_INACTIVE; + /* + * All the buffers may be freed after returning to caller, so + * set msgs to NULL to avoid memory reference after freeing. + */ + bus->msgs = NULL; spin_unlock_irqrestore(&bus->lock, flags); return -ETIMEDOUT;