ATH10K Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Kalle Valo <kvalo@qca.qualcomm.com>
To: Michal Kazior <michal.kazior@tieto.com>
Cc: linux-wireless@vger.kernel.org, ath10k@lists.infradead.org
Subject: Re: [PATCH] ath10k: prevent debugfs mmio access crash kernel
Date: Tue, 16 Jun 2015 13:11:41 +0300	[thread overview]
Message-ID: <87ioao7yjm.fsf@kamboji.qca.qualcomm.com> (raw)
In-Reply-To: <1434008594-6726-1-git-send-email-michal.kazior@tieto.com> (Michal Kazior's message of "Thu, 11 Jun 2015 09:43:14 +0200")

Michal Kazior <michal.kazior@tieto.com> writes:

> It was possible to force an out of bounds MMIO
> read/write via debugfs. E.g. on QCA988X this could
> be triggered with:
>
>  echo 0x2080e0 | tee /sys/kernel/debug/ieee80211/*/ath10k/reg_addr
>  cat /sys/kernel/debug/ieee80211/*/ath10k/reg_value
>
>  BUG: unable to handle kernel paging request at ffffc90001e080e0
>  IP: [<ffffffff8135c860>] ioread32+0x40/0x50
>  ...
>  Call Trace:
>   [<ffffffffa00d0c7f>] ? ath10k_pci_read32+0x4f/0x70 [ath10k_pci]
>   [<ffffffffa0080f50>] ath10k_reg_value_read+0x90/0xf0 [ath10k_core]
>   [<ffffffff8115c2c1>] ? handle_mm_fault+0xa91/0x1050
>   [<ffffffff81189758>] __vfs_read+0x28/0xe0
>   [<ffffffff812e4694>] ? security_file_permission+0x84/0xa0
>   [<ffffffff81189ce3>] ? rw_verify_area+0x53/0x100
>   [<ffffffff81189e1a>] vfs_read+0x8a/0x140
>   [<ffffffff8118acb9>] SyS_read+0x49/0xb0
>   [<ffffffff8104e39c>] ? trace_do_page_fault+0x3c/0xc0
>   [<ffffffff8196596e>] system_call_fastpath+0x12/0x71
>
> Reported-by: Ben Greear <greearb@candelatech.com>
> Signed-off-by: Michal Kazior <michal.kazior@tieto.com>

Thanks, applied.

-- 
Kalle Valo

_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

  reply	other threads:[~2015-06-16 10:12 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-06-11  7:43 [PATCH] ath10k: prevent debugfs mmio access crash kernel Michal Kazior
2015-06-16 10:11 ` Kalle Valo [this message]
2015-06-16 11:26   ` repeater mode not working Sebastian Gottschall
2015-06-17  5:26     ` Michal Kazior

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87ioao7yjm.fsf@kamboji.qca.qualcomm.com \
    --to=kvalo@qca.qualcomm.com \
    --cc=ath10k@lists.infradead.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=michal.kazior@tieto.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox