* [PATCH] spi: nxp-fspi: fix the KASAN report out-of-bounds bug
@ 2024-09-11 21:11 Han Xu
2024-09-12 16:43 ` Mark Brown
0 siblings, 1 reply; 2+ messages in thread
From: Han Xu @ 2024-09-11 21:11 UTC (permalink / raw)
To: Han Xu, Haibo Chen, Yogesh Gaur, Mark Brown, Yogesh Narayan Gaur,
Frieder Schrempf, Boris Brezillon
Cc: stable, linux-spi, imx, linux-kernel
Change the memcpy length to fix the out-of-bounds issue when writing the
data that is not 4 byte aligned to TX FIFO.
To reproduce the issue, write 3 bytes data to NOR chip.
dd if=3b of=/dev/mtd0
[ 36.926103] ==================================================================
[ 36.933409] BUG: KASAN: slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838
[ 36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455
[ 36.946721]
[ 36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070
[ 36.956185] Hardware name: Freescale i.MX8QM MEK (DT)
[ 36.961260] Call trace:
[ 36.963723] dump_backtrace+0x90/0xe8
[ 36.967414] show_stack+0x18/0x24
[ 36.970749] dump_stack_lvl+0x78/0x90
[ 36.974451] print_report+0x114/0x5cc
[ 36.978151] kasan_report+0xa4/0xf0
[ 36.981670] __asan_report_load_n_noabort+0x1c/0x28
[ 36.986587] nxp_fspi_exec_op+0x26ec/0x2838
[ 36.990800] spi_mem_exec_op+0x8ec/0xd30
[ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0
[ 36.999323] spi_mem_dirmap_write+0x238/0x32c
[ 37.003710] spi_nor_write_data+0x220/0x374
[ 37.007932] spi_nor_write+0x110/0x2e8
[ 37.011711] mtd_write_oob_std+0x154/0x1f0
[ 37.015838] mtd_write_oob+0x104/0x1d0
[ 37.019617] mtd_write+0xb8/0x12c
[ 37.022953] mtdchar_write+0x224/0x47c
[ 37.026732] vfs_write+0x1e4/0x8c8
[ 37.030163] ksys_write+0xec/0x1d0
[ 37.033586] __arm64_sys_write+0x6c/0x9c
[ 37.037539] invoke_syscall+0x6c/0x258
[ 37.041327] el0_svc_common.constprop.0+0x160/0x22c
[ 37.046244] do_el0_svc+0x44/0x5c
[ 37.049589] el0_svc+0x38/0x78
[ 37.052681] el0t_64_sync_handler+0x13c/0x158
[ 37.057077] el0t_64_sync+0x190/0x194
[ 37.060775]
[ 37.062274] Allocated by task 455:
[ 37.065701] kasan_save_stack+0x2c/0x54
[ 37.069570] kasan_save_track+0x20/0x3c
[ 37.073438] kasan_save_alloc_info+0x40/0x54
[ 37.077736] __kasan_kmalloc+0xa0/0xb8
[ 37.081515] __kmalloc_noprof+0x158/0x2f8
[ 37.085563] mtd_kmalloc_up_to+0x120/0x154
[ 37.089690] mtdchar_write+0x130/0x47c
[ 37.093469] vfs_write+0x1e4/0x8c8
[ 37.096901] ksys_write+0xec/0x1d0
[ 37.100332] __arm64_sys_write+0x6c/0x9c
[ 37.104287] invoke_syscall+0x6c/0x258
[ 37.108064] el0_svc_common.constprop.0+0x160/0x22c
[ 37.112972] do_el0_svc+0x44/0x5c
[ 37.116319] el0_svc+0x38/0x78
[ 37.119401] el0t_64_sync_handler+0x13c/0x158
[ 37.123788] el0t_64_sync+0x190/0x194
[ 37.127474]
[ 37.128977] The buggy address belongs to the object at ffff00081037c2a0
[ 37.128977] which belongs to the cache kmalloc-8 of size 8
[ 37.141177] The buggy address is located 0 bytes inside of
[ 37.141177] allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3)
[ 37.153465]
[ 37.154971] The buggy address belongs to the physical page:
[ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c
[ 37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[ 37.175149] page_type: 0xfdffffff(slab)
[ 37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000
[ 37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000
[ 37.194553] page dumped because: kasan: bad access detected
[ 37.200144]
[ 37.201647] Memory state around the buggy address:
[ 37.206460] ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc
[ 37.220946] >ffff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc
[ 37.228186] ^
[ 37.232473] ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 37.239718] ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 37.246962] ==================================================================
[ 37.254394] Disabling lock debugging due to kernel taint
0+1 records in
0+1 records out
3 bytes copied, 0.335911 s, 0.0 kB/s
Fixes: a5356aef6a90 ("spi: spi-mem: Add driver for NXP FlexSPI controller")
Cc: stable@kernel.org
Signed-off-by: Han Xu <han.xu@nxp.com>
---
drivers/spi/spi-nxp-fspi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
index 69e427b1903b..5a1e55a01c52 100644
--- a/drivers/spi/spi-nxp-fspi.c
+++ b/drivers/spi/spi-nxp-fspi.c
@@ -812,14 +812,15 @@ static void nxp_fspi_fill_txfifo(struct nxp_fspi *f,
if (i < op->data.nbytes) {
u32 data = 0;
int j;
+ int remaining = op->data.nbytes - i;
/* Wait for TXFIFO empty */
ret = fspi_readl_poll_tout(f, f->iobase + FSPI_INTR,
FSPI_INTR_IPTXWE, 0,
POLL_TOUT, true);
WARN_ON(ret);
- for (j = 0; j < ALIGN(op->data.nbytes - i, 4); j += 4) {
- memcpy(&data, buf + i + j, 4);
+ for (j = 0; j < ALIGN(remaining, 4); j += 4) {
+ memcpy(&data, buf + i + j, min_t(int, 4, remaining - j));
fspi_writel(f, data, base + FSPI_TFDR + j);
}
fspi_writel(f, FSPI_INTR_IPTXWE, base + FSPI_INTR);
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] spi: nxp-fspi: fix the KASAN report out-of-bounds bug
2024-09-11 21:11 [PATCH] spi: nxp-fspi: fix the KASAN report out-of-bounds bug Han Xu
@ 2024-09-12 16:43 ` Mark Brown
0 siblings, 0 replies; 2+ messages in thread
From: Mark Brown @ 2024-09-12 16:43 UTC (permalink / raw)
To: Haibo Chen, Yogesh Gaur, Yogesh Narayan Gaur, Frieder Schrempf,
Boris Brezillon, Han Xu
Cc: stable, linux-spi, imx, linux-kernel
On Wed, 11 Sep 2024 16:11:45 -0500, Han Xu wrote:
> Change the memcpy length to fix the out-of-bounds issue when writing the
> data that is not 4 byte aligned to TX FIFO.
>
> To reproduce the issue, write 3 bytes data to NOR chip.
>
> dd if=3b of=/dev/mtd0
> [ 36.926103] ==================================================================
> [ 36.933409] BUG: KASAN: slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838
> [ 36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455
> [ 36.946721]
> [ 36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070
> [ 36.956185] Hardware name: Freescale i.MX8QM MEK (DT)
> [ 36.961260] Call trace:
> [ 36.963723] dump_backtrace+0x90/0xe8
> [ 36.967414] show_stack+0x18/0x24
> [ 36.970749] dump_stack_lvl+0x78/0x90
> [ 36.974451] print_report+0x114/0x5cc
> [ 36.978151] kasan_report+0xa4/0xf0
> [ 36.981670] __asan_report_load_n_noabort+0x1c/0x28
> [ 36.986587] nxp_fspi_exec_op+0x26ec/0x2838
> [ 36.990800] spi_mem_exec_op+0x8ec/0xd30
> [ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0
> [ 36.999323] spi_mem_dirmap_write+0x238/0x32c
> [ 37.003710] spi_nor_write_data+0x220/0x374
> [ 37.007932] spi_nor_write+0x110/0x2e8
> [ 37.011711] mtd_write_oob_std+0x154/0x1f0
> [ 37.015838] mtd_write_oob+0x104/0x1d0
> [ 37.019617] mtd_write+0xb8/0x12c
> [ 37.022953] mtdchar_write+0x224/0x47c
> [ 37.026732] vfs_write+0x1e4/0x8c8
> [ 37.030163] ksys_write+0xec/0x1d0
> [ 37.033586] __arm64_sys_write+0x6c/0x9c
> [ 37.037539] invoke_syscall+0x6c/0x258
> [ 37.041327] el0_svc_common.constprop.0+0x160/0x22c
> [ 37.046244] do_el0_svc+0x44/0x5c
> [ 37.049589] el0_svc+0x38/0x78
> [ 37.052681] el0t_64_sync_handler+0x13c/0x158
> [ 37.057077] el0t_64_sync+0x190/0x194
> [ 37.060775]
> [ 37.062274] Allocated by task 455:
> [ 37.065701] kasan_save_stack+0x2c/0x54
> [ 37.069570] kasan_save_track+0x20/0x3c
> [ 37.073438] kasan_save_alloc_info+0x40/0x54
> [ 37.077736] __kasan_kmalloc+0xa0/0xb8
> [ 37.081515] __kmalloc_noprof+0x158/0x2f8
> [ 37.085563] mtd_kmalloc_up_to+0x120/0x154
> [ 37.089690] mtdchar_write+0x130/0x47c
> [ 37.093469] vfs_write+0x1e4/0x8c8
> [ 37.096901] ksys_write+0xec/0x1d0
> [ 37.100332] __arm64_sys_write+0x6c/0x9c
> [ 37.104287] invoke_syscall+0x6c/0x258
> [ 37.108064] el0_svc_common.constprop.0+0x160/0x22c
> [ 37.112972] do_el0_svc+0x44/0x5c
> [ 37.116319] el0_svc+0x38/0x78
> [ 37.119401] el0t_64_sync_handler+0x13c/0x158
> [ 37.123788] el0t_64_sync+0x190/0x194
> [ 37.127474]
> [ 37.128977] The buggy address belongs to the object at ffff00081037c2a0
> [ 37.128977] which belongs to the cache kmalloc-8 of size 8
> [ 37.141177] The buggy address is located 0 bytes inside of
> [ 37.141177] allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3)
> [ 37.153465]
> [ 37.154971] The buggy address belongs to the physical page:
> [ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c
> [ 37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
> [ 37.175149] page_type: 0xfdffffff(slab)
> [ 37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000
> [ 37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000
> [ 37.194553] page dumped because: kasan: bad access detected
> [ 37.200144]
> [ 37.201647] Memory state around the buggy address:
> [ 37.206460] ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
> [ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc
> [ 37.220946] >ffff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc
> [ 37.228186] ^
> [ 37.232473] ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 37.239718] ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 37.246962] ==================================================================
> [ 37.254394] Disabling lock debugging due to kernel taint
> 0+1 records in
> 0+1 records out
> 3 bytes copied, 0.335911 s, 0.0 kB/s
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-next
Thanks!
[1/1] spi: nxp-fspi: fix the KASAN report out-of-bounds bug
commit: 2a8787c1cdc7be24fdd8953ecd1a8743a1006235
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-09-12 16:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-09-11 21:11 [PATCH] spi: nxp-fspi: fix the KASAN report out-of-bounds bug Han Xu
2024-09-12 16:43 ` Mark Brown
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox