The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable@xxxxxxxxxxxxxxx>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x eff9704f5332a13b08fbdbe0f84059c9e7051d5f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable@xxxxxxxxxxxxxxx>' --in-reply-to '2024012629-motto-fidgeting-3df6@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: eff9704f5332 ("bus: mhi: host: Add alignment check for event ring read pointer") a0f5a630668c ("bus: mhi: Move host MHI code to "host" directory") ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") 855a70c12021 ("bus: mhi: Add MHI PCI support for WWAN modems") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From eff9704f5332a13b08fbdbe0f84059c9e7051d5f Mon Sep 17 00:00:00 2001 From: Krishna chaitanya chundru <quic_krichai@xxxxxxxxxxx> Date: Tue, 31 Oct 2023 15:21:05 +0530 Subject: [PATCH] bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Krishna chaitanya chundru <quic_krichai@xxxxxxxxxxx> Reviewed-by: Jeffrey Hugo <quic_jhugo@xxxxxxxxxxx> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@xxxxxxxxxxx Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx> diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 6cf11457380b..d80975f4bba8 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -269,7 +269,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_ring_element) - 1)); } int mhi_destroy_device(struct device *dev, void *data)
