From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yazen Ghannam <yazen.ghannam@amd.com>,
Borislav Petkov <bp@alien8.de>,
Mario Limonciello <mario.limonciello@amd.com>,
Guenter Roeck <linux@roeck-us.net>,
Sasha Levin <sashal@kernel.org>,
clemens@ladisch.de, jdelvare@suse.com,
linux-hwmon@vger.kernel.org
Subject: [PATCH AUTOSEL 6.1 36/61] hwmon: (k10temp) Check return value of amd_smn_read()
Date: Wed, 31 Jul 2024 20:25:54 -0400 [thread overview]
Message-ID: <20240801002803.3935985-36-sashal@kernel.org> (raw)
In-Reply-To: <20240801002803.3935985-1-sashal@kernel.org>
From: Yazen Ghannam <yazen.ghannam@amd.com>
[ Upstream commit c2d79cc5455c891de6c93e1e0c73d806e299c54f ]
Check the return value of amd_smn_read() before saving a value. This
ensures invalid values aren't saved or used.
There are three cases here with slightly different behavior:
1) read_tempreg_nb_zen():
This is a function pointer which does not include a return code.
In this case, set the register value to 0 on failure. This
enforces Read-as-Zero behavior.
2) k10temp_read_temp():
This function does have return codes, so return the error code
from the failed register read. Continued operation is not
necessary, since there is no valid data from the register.
Furthermore, if the register value was set to 0, then the
following operation would underflow.
3) k10temp_get_ccd_support():
This function reads the same register from multiple CCD
instances in a loop. And a bitmask is formed if a specific bit
is set in each register instance. The loop should continue on a
failed register read, skipping the bit check.
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20240606-fix-smn-bad-read-v4-3-ffde21931c3f@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/k10temp.c | 36 +++++++++++++++++++++++++++---------
1 file changed, 27 insertions(+), 9 deletions(-)
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 43aa955ec120d..74a4901640346 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -153,8 +153,9 @@ static void read_tempreg_nb_f15(struct pci_dev *pdev, u32 *regval)
static void read_tempreg_nb_zen(struct pci_dev *pdev, u32 *regval)
{
- amd_smn_read(amd_pci_dev_to_node_id(pdev),
- ZEN_REPORTED_TEMP_CTRL_BASE, regval);
+ if (amd_smn_read(amd_pci_dev_to_node_id(pdev),
+ ZEN_REPORTED_TEMP_CTRL_BASE, regval))
+ *regval = 0;
}
static long get_raw_temp(struct k10temp_data *data)
@@ -205,6 +206,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel,
long *val)
{
struct k10temp_data *data = dev_get_drvdata(dev);
+ int ret = -EOPNOTSUPP;
u32 regval;
switch (attr) {
@@ -221,13 +223,17 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel,
*val = 0;
break;
case 2 ... 13: /* Tccd{1-12} */
- amd_smn_read(amd_pci_dev_to_node_id(data->pdev),
- ZEN_CCD_TEMP(data->ccd_offset, channel - 2),
- ®val);
+ ret = amd_smn_read(amd_pci_dev_to_node_id(data->pdev),
+ ZEN_CCD_TEMP(data->ccd_offset, channel - 2),
+ ®val);
+
+ if (ret)
+ return ret;
+
*val = (regval & ZEN_CCD_TEMP_MASK) * 125 - 49000;
break;
default:
- return -EOPNOTSUPP;
+ return ret;
}
break;
case hwmon_temp_max:
@@ -243,7 +249,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel,
- ((regval >> 24) & 0xf)) * 500 + 52000;
break;
default:
- return -EOPNOTSUPP;
+ return ret;
}
return 0;
}
@@ -381,8 +387,20 @@ static void k10temp_get_ccd_support(struct pci_dev *pdev,
int i;
for (i = 0; i < limit; i++) {
- amd_smn_read(amd_pci_dev_to_node_id(pdev),
- ZEN_CCD_TEMP(data->ccd_offset, i), ®val);
+ /*
+ * Ignore inaccessible CCDs.
+ *
+ * Some systems will return a register value of 0, and the TEMP_VALID
+ * bit check below will naturally fail.
+ *
+ * Other systems will return a PCI_ERROR_RESPONSE (0xFFFFFFFF) for
+ * the register value. And this will incorrectly pass the TEMP_VALID
+ * bit check.
+ */
+ if (amd_smn_read(amd_pci_dev_to_node_id(pdev),
+ ZEN_CCD_TEMP(data->ccd_offset, i), ®val))
+ continue;
+
if (regval & ZEN_CCD_TEMP_VALID)
data->show_temp |= BIT(TCCD_BIT(i));
}
--
2.43.0
next prev parent reply other threads:[~2024-08-01 0:30 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-01 0:25 [PATCH AUTOSEL 6.1 01/61] drm/amd/display: Assign linear_pitch_alignment even for VM Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 02/61] drm/amdgpu: fix overflowed array index read warning Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 03/61] drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 04/61] drm/amd/pm: fix warning using uninitialized value of max_vid_step Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 05/61] drm/amd/pm: Fix negative array index read Sasha Levin
2024-08-27 12:29 ` Pavel Machek
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 06/61] drm/amd/pm: fix the Out-of-bounds read warning Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 07/61] drm/amd/display: Check gpio_id before used as array index Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 08/61] drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 09/61] drm/amd/display: Add array index check for hdcp ddc access Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 10/61] drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 11/61] drm/amd/display: Check msg_id before processing transcation Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 12/61] drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 13/61] drm/amd/display: Spinlock before reading event Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 14/61] drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 15/61] drm/amd/amdgpu: Check tbo resource pointer Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 16/61] drm/amdgpu: Fix out-of-bounds write warning Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 17/61] drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 18/61] drm/amdgpu: fix ucode out-of-bounds read warning Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 19/61] drm/amdgpu: fix mc_data " Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 20/61] drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 21/61] wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem() Sasha Levin
2024-08-27 12:27 ` Pavel Machek
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 22/61] drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 23/61] drm/amdgpu: fix dereference after null check Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 24/61] drm/amdgpu: fix the waring dereferencing hive Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 25/61] drm/amdgpu: the warning dereferencing obj for nbio_v7_4 Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 26/61] drm/amdgpu: update type of buf size to u32 for eeprom functions Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 27/61] wifi: iwlwifi: fw: avoid bad FW config on RXQ DMA failure Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 28/61] cpufreq: scmi: Avoid overflow of target_freq in fast switch Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 29/61] bpf, net: Use DEV_STAT_INC() Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 30/61] PCI: al: Check IORESOURCE_BUS existence during probe Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 31/61] hwspinlock: Introduce hwspin_lock_bust() Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 32/61] gpiolib: cdev: Add INIT_KFIFO() for linereq events Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 33/61] pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 34/61] smack: tcp: ipv4, fix incorrect labeling Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 35/61] drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ Sasha Levin
2024-08-01 0:25 ` Sasha Levin [this message]
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 37/61] wifi: cfg80211: make hash table duplicates more survivable Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 38/61] driver: iio: add missing checks on iio_info's callback access Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 39/61] drm/amd/display: added NULL check at start of dc_validate_stream Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 40/61] drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX Sasha Levin
2024-08-01 0:25 ` [PATCH AUTOSEL 6.1 41/61] drm/amd/display: Skip wbscl_set_scaler_filter if filter is null Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 42/61] ALSA: vmaster: Return error for invalid input values Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 43/61] ALSA: control: Apply sanity check of input values for user elements Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 44/61] ELF: fix kernel.randomize_va_space double read Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 45/61] x86/kmsan: Fix hook for unaligned accesses Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 46/61] udf: Avoid excessive partition lengths Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 47/61] riscv: mm: Take memory hotplug read-lock during kernel page table dump Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 48/61] usb: uas: set host status byte on data completion error Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 49/61] drm/amd/display: Check HDCP returned status Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 50/61] drm/amd/display: Check denominator pbn_div before used Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 51/61] phy: zynqmp: Take the phy mutex in xlate Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 52/61] cgroup: Protect css->cgroup write under css_set_lock Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 53/61] um: line: always fill *error_out in setup_one_line() Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 54/61] devres: Initialize an uninitialized struct member Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 55/61] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 56/61] hwmon: (lm95234) Fix underflows seen when writing limit attributes Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 57/61] hwmon: (nct6775-core) " Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 58/61] hwmon: (w83627ehf) " Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 59/61] libbpf: Add NULL checks to bpf_object__{prev_map,next_map} Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 60/61] wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() Sasha Levin
2024-08-01 0:26 ` [PATCH AUTOSEL 6.1 61/61] i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240801002803.3935985-36-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=bp@alien8.de \
--cc=clemens@ladisch.de \
--cc=jdelvare@suse.com \
--cc=linux-hwmon@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=mario.limonciello@amd.com \
--cc=stable@vger.kernel.org \
--cc=yazen.ghannam@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox