linux-kernel - [PATCH 1/1] Fix NULL pointer dereference in imx serial driver DMA callback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed,  3 Aug 2016 12:59:26 +0200
From:	Fabien Lahoudere <fabien.lahoudere@...labora.co.uk>
To:	unlisted-recipients:; (no To-header on input)
Cc:	Hannu Koivisto <hannu.koivisto@...cit.fi>,
	Fabien Lahoudere <fabien.lahoudere@...labora.co.uk>,
	Vinod Koul <vinod.koul@...el.com>,
	Dan Williams <dan.j.williams@...el.com>,
	dmaengine@...r.kernel.org (open list:DMA GENERIC OFFLOAD ENGINE
	SUBSYSTEM), linux-kernel@...r.kernel.org (open list)
Subject: [PATCH 1/1] Fix NULL pointer dereference in imx serial driver DMA callback

From: Hannu Koivisto <hannu.koivisto@...cit.fi>

dma_rx_callback() may see NULL dma_chan_rx if DMA interrupt [1] occurs a
moment[2] before imx_uart_dma_exit() sets it to NULL.  imx_uart_dma_exit()
calls dmaengine_terminate_all() and dma_release_channel() but neither of
those prevent the callback being called after they have returned. A similar
problem has been discussed by ALSA developers
(http://mailman.alsa-project.org/pipermail/alsa-devel/2013-October/067239.html)
and it was pointed out that dmaengine_terminate_all() might be called from
the callback, so we cannot call tasklet_kill() in imx-sdma's code called by
dmaengine_terminate_all().

Hopefully it doesn't make sense to call dma_release_channel() from the
callback, so instead of adding synchronization to imx serial driver, we add
tasklet_kill() call to sdma_free_chan_resources().  While most DMA drivers
don't do that, there is one example that does: pl330.

[1] It schedules sdma_tasklet, which again calls the dma_rx_callback.
[2] I tested this by scheduling the sdma tasklet as far as right before the
imx_stop_tx() call in imx_shutdown() and the problem occurred.

Signed-off-by: Fabien Lahoudere <fabien.lahoudere@...labora.co.uk>
---
 drivers/dma/imx-sdma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 46c9027..da86792 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1135,6 +1135,8 @@ static void sdma_free_chan_resources(struct dma_chan *chan)

 	sdma_disable_channel(chan);

+	tasklet_kill(&sdmac->tasklet);
+
 	if (sdmac->event_id0)
 		sdma_event_disable(sdmac, sdmac->event_id0);
 	if (sdmac->event_id1)
-- 
2.7.4