From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lj1-f177.google.com (mail-lj1-f177.google.com [209.85.208.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB5E347AF49 for ; Tue, 16 Jun 2026 17:27:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781630867; cv=none; b=qErxad5qzvwY3CrcSxk6rXwS6VOCYIpEovkYOp8h6TeLQDls2MBFMV9S8Jj43Ydl/nUOEbeR97dw2U17hk/6AK81D6VD1ByD0LheLfBUw+qRP+Fp2kl5+gCxP+4AurF14bo5FEbxiBGhJ+bX8eQDj5Ma56cwGn7iUPpB0sR66fw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781630867; c=relaxed/simple; bh=O8cbjHqHqtkMgHfh7cfL3XvH7d1YL05sNt3MZ69NqSk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AoFWOuCEe2OtDHWj3GJKXhTjfOaataxoRbvA3UPDCs1UBjAo1hczwhPt/FGO88au7iYiTktwCGKLGZvDipMDalN4zMggt/OVb4PZBWX1TY1wCSPkJRGabNmEIJvtl01eBgb471anMReilpjGZhtDIk1laRzhm3Ruys51I5AxJHo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qF3V3AJP; arc=none smtp.client-ip=209.85.208.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qF3V3AJP" Received: by mail-lj1-f177.google.com with SMTP id 38308e7fff4ca-3967717c951so59941111fa.1 for ; Tue, 16 Jun 2026 10:27:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781630861; x=1782235661; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=8ihatTAgtIM75Y72cnH9JImL7Y6UJlEwRW9iaLN7oWc=; b=qF3V3AJPMBkAunfzp6smDuq50T8vfHKKgXaMbD+DMCaFiLRiAUbOxUSTvux5azhrVS GdrLW6Zn37NC3jvHHlg+/nPtMtiS+Eep73n6zefZHlGUZlla/C8Vn2EoJDhO/BpOgfLx DTSacEVcL72kOZ3UxHFbB9+hsZPMYH+wrZmCwVxwkhy0r+0tbUlbCpP099GWTOFit6+/ XuD43zN6zqsu8WcJJRIUKX82lMJftJAGLgrk23PRGLrKF3i4Mtgqcsr9jzdrBBy/E4Xb hTLZ21rhWnB0U3274ZDhzJZaD1SV+/w6lVSztDo4918TMm57pdwQYyfHQYkrlAnKQvzQ m7/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781630861; x=1782235661; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=8ihatTAgtIM75Y72cnH9JImL7Y6UJlEwRW9iaLN7oWc=; b=ZAM5LUY9nFossezCNlCadJEYEki39w+PZTbiAdp408GD+J6vQVCh+Mwe5G239sZmMe AllXJ8aFPbJgdX20Y3rzdCjAY2XHp+YHEiuDc3xl3On1eCGG/sqgxVfqenapmMSkcUIE t7HWuPGdPfpL+PBgZLSIiNxRZ2VUtP26aRT72DpQJmszb4CskchdxvhuYo1Up2V4mHZj AhukEmwU/cKBv8gHb6RtsEQyzAZjzzohUhvS0gczhz64yxpvkWmR/OXjYuZ8R5f3arHQ XQvSYFvY1a1aevVqndaiYBuBNOy5TQIfVSanjcL7m0HJghCpROzeRK+newx1wrobnXzW 6yIw== X-Forwarded-Encrypted: i=1; AFNElJ8Y6Xf0v7l3lXTpmyOQRvNDoygeFPys5CHtfqXg3nIppTBcVqfDVUI8tdz87k3l7vmj7N3LpN4cDYfryO8=@vger.kernel.org X-Gm-Message-State: AOJu0Yw1tsSI1FYHzmkAZdfcqL2rNfjL29Fapw4tqGgVpNPIanHQWOPQ LubhJ12WmwmY93C92C3CLTEEA5F4ZVO1Selz4hz5c6X0QyI+XTpkKJuc X-Gm-Gg: Acq92OF66gaDHil8zIb0W6GW+LDzYR0BtzjscBszQMZ//XOR7aiQex/1d2ViuGRI+TQ mIJRF6zpjdRU6vc+AMMBFWlVB0PoMtvKjWBhHVYNOboNJ4QF+PUPLKFVGn12XnW2a7N94VIBGDo H8GDb+vEMCMquECPOReGGcZDbTNCDqPG8GcXkwThSJsjnafndRHh8SzO3zkCz9LWnLxPkAILS2e 2VDjWNae+KcFfN+ywlrN6ma975/VZkRu8Cm3F7RhnBeWXKt98dCLJ5r0s2/oFfE/XaYyqivFFDb d6pm0Q8AbMPs2Y1HTZJ8BgwllxbH3x4nigCe5VMKR6icgHzcIhnq6HFm+QdQrUDBsBFBvUFEquE QCMRcCUizA4LcXyardgwYMpVOS6VMAq54Oh8JPx8SQ5SoFtqhW8PdwkQTB/hWlJ+OIC/Sqbdjuu M6maX5/8x2sMGbPXziLgifHdI6Cgry2gYY+eyuD4c= X-Received: by 2002:a2e:9a0f:0:b0:396:7b20:1a77 with SMTP id 38308e7fff4ca-3993575584fmr52468591fa.22.1781630860527; Tue, 16 Jun 2026 10:27:40 -0700 (PDT) Received: from grower.astra-academy.ru ([185.32.135.49]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-3995c05acfcsm7978201fa.13.2026.06.16.10.27.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 10:27:40 -0700 (PDT) From: Alexander Martyniuk To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Alexander Martyniuk , Manivannan Sadhasivam , Hemant Kumar , Krishna chaitanya chundru , Jeffrey Hugo , linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Manivannan Sadhasivam , Jeff Hugo , Loic Poulain , Youssef Samir , Vivek Pernamitta , mhi@lists.linux.dev, lvc-project@linuxtesting.org Subject: [PATCH 5.10] bus: mhi: host: Add alignment check for event ring read pointer Date: Tue, 16 Jun 2026 20:27:42 +0000 Message-ID: <20260616202743.84303-1-alexevgmart@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Krishna chaitanya chundru commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f upstream. Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable@vger.kernel.org Signed-off-by: Krishna chaitanya chundru Reviewed-by: Jeffrey Hugo Reviewed-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicinc.com Signed-off-by: Manivannan Sadhasivam Signed-off-by: Alexander Martyniuk --- Backport fix for CVE-2023-52494 drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 49c0f5ad0b73..57c8d15b687c 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.47.3