• Vincent Whitchurch's avatar
    i2c: virtio: disable timeout handling · 84e1d0bf
    Vincent Whitchurch authored
    If a timeout is hit, it can result is incorrect data on the I2C bus
    and/or memory corruptions in the guest since the device can still be
    operating on the buffers it was given while the guest has freed them.
    
    Here is, for example, the start of a slub_debug splat which was
    triggered on the next transfer after one transfer was forced to timeout
    by setting a breakpoint in the backend (rust-vmm/vhost-device):
    
     BUG kmalloc-1k (Not tainted): Poison overwritten
     First byte 0x1 instead of 0x6b
     Allocated in virtio_i2c_xfer+0x65/0x35c age=350 cpu=0 pid=29
     	__kmalloc+0xc2/0x1c9
     	virtio_i2c_xfer+0x65/0x35c
     	__i2c_transfer+0x429/0x57d
     	i2c_transfer+0x115/0x134
     	i2cdev_ioctl_rdwr+0x16a/0x1de
     	i2cdev_ioctl+0x247/0x2ed
     	vfs_ioctl+0x21/0x30
     	sys_ioctl+0xb18/0xb41
     Freed in virtio_i2c_xfer+0x32e/0x35c age=244 cpu=0 pid=29
     	kfree+0x1bd/0x1cc
     	virtio_i2c_xfer+0x32e/0x35c
     	__i2c_transfer+0x429/0x57d
     	i2c_transfer+0x115/0x134
     	i2cdev_ioctl_rdwr+0x16a/0x1de
     	i2cdev_ioctl+0x247/0x2ed
     	vfs_ioctl+0x21/0x30
     	sys_ioctl+0xb18/0xb41
    
    There is no simple fix for this (the driver would have to always create
    bounce buffers and hold on to them until the device eventually returns
    the buffers), so just disable the timeout support for now.
    
    Fixes: 3cfc8838 ("i2c: virtio: add a virtio i2c frontend driver")
    Acked-by: default avatarJie Deng <jie.deng@intel.com>
    Signed-off-by: default avatarVincent Whitchurch <vincent.whitchurch@axis.com>
    Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    Reviewed-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
    84e1d0bf
i2c-virtio.c 6.94 KB