From patchwork Mon Apr 8 18:35:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1921012 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VCySq15Xvz1yYf for ; Tue, 9 Apr 2024 04:35:22 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rttpm-00048K-4U; Mon, 08 Apr 2024 18:35:10 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rttpk-000481-Hw for kernel-team@lists.ubuntu.com; Mon, 08 Apr 2024 18:35:08 +0000 Received: from mail-io1-f71.google.com (mail-io1-f71.google.com [209.85.166.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 4A6633F188 for ; Mon, 8 Apr 2024 18:35:08 +0000 (UTC) Received: by mail-io1-f71.google.com with SMTP id ca18e2360f4ac-7d34f49058fso406397439f.0 for ; Mon, 08 Apr 2024 11:35:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712601307; x=1713206107; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jnI9+5qKod6qPGygMtYcNqIvT+WasKmu4ayIrYcnfkM=; b=iLaywln5cF48SkN8ieoR0zGEcOR1pe02tMtOKVvIY/nSuDhvyDZ0iFVeJYNAjjgNGF HZw4gIspyPg5+y4pJdZSUYGSoCRp3/yX1fx7csPfWtIrwZVDHIAJOgtEudKa0r9vXdZx 3sqk+I0PdqKYpUucA6ISuGQxOdxNr7f110tc1OX2SarYN6Wf4Ayft/YqCo9BvsGqjEe2 aV7wNMbzusM/Xm9ZQKdX62QOxwzdmpfwfnNJBx+w3ysKZntEyc0Kk0+ZWhANd63LjneW udlCpchMDARA7+KA1DU3JM25zOJGX0XfOAQZbYuZwyipZZj2eYFfaePhPeNxnVh747ug rwYA== X-Gm-Message-State: AOJu0YzkTkLm1XenHsGfIf2GmOaUku2uLkd9IygvmFC6W6L+NyeVGFRH JWaBF42GlxLqeJRo1bAKwqMKVnzrDQ768xht0TsKpKlBelVtO8CXjQ5LMxT1HPQVBJNO6U7EdUC 0jH57R5fW6Q6ktxWLqDgkHphSR2sDx2xqViEfE3RDNaK1ywy1osvHqLAc2357T9NowTi6Xt5Z+4 0yvGcREFA/sw== X-Received: by 2002:a05:6602:3a10:b0:7d5:c744:77e4 with SMTP id by16-20020a0566023a1000b007d5c74477e4mr9775391iob.10.1712601307102; Mon, 08 Apr 2024 11:35:07 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEPE15nOFNzjLWALuCzpCX3w6yaAHcJPEw/8gvLXd1hhvObt7cvFJBvwVjVecrtqBLMmmkeyA== X-Received: by 2002:a05:6602:3a10:b0:7d5:c744:77e4 with SMTP id by16-20020a0566023a1000b007d5c74477e4mr9775375iob.10.1712601306778; Mon, 08 Apr 2024 11:35:06 -0700 (PDT) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id s9-20020a056638218900b0047ec1007689sm2661263jaj.71.2024.04.08.11.35.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Apr 2024 11:35:06 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][M][PATCH 1/1] i2c: i801: Fix block process call transactions Date: Mon, 8 Apr 2024 13:35:04 -0500 Message-Id: <20240408183504.18465-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240408183504.18465-1-bethany.jamison@canonical.com> References: <20240408183504.18465-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jean Delvare According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once again before reading the incoming data from the buffer. The driver is currently missing the second reset, causing the wrong portion of the block buffer to be read. Signed-off-by: Jean Delvare Reported-by: Piotr Zakowski Closes: https://lore.kernel.org/linux-i2c/20240213120553.7b0ab120@endymion.delvare/ Fixes: 315cd67c9453 ("i2c: i801: Add Block Write-Block Read Process Call support") Reviewed-by: Alexander Sverdlin Signed-off-by: Andi Shyti (cherry picked from commit c1c9d0f6f7f1dbf29db996bd8e166242843a5f21) CVE-2024-26593 Signed-off-by: Bethany Jamison --- drivers/i2c/busses/i2c-i801.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c index 7d78df30fe132..6d1f138152556 100644 --- a/drivers/i2c/busses/i2c-i801.c +++ b/drivers/i2c/busses/i2c-i801.c @@ -500,11 +500,10 @@ static int i801_block_transaction_by_block(struct i801_priv *priv, /* Set block buffer mode */ outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv)); - inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ - if (read_write == I2C_SMBUS_WRITE) { len = data->block[0]; outb_p(len, SMBHSTDAT0(priv)); + inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ for (i = 0; i < len; i++) outb_p(data->block[i+1], SMBBLKDAT(priv)); } @@ -522,6 +521,7 @@ static int i801_block_transaction_by_block(struct i801_priv *priv, } data->block[0] = len; + inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ for (i = 0; i < len; i++) data->block[i + 1] = inb_p(SMBBLKDAT(priv)); }