linux-kernel - Re: [PATCH] DMA: PL330: Fix racy mutex unlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJe_ZheY6o3Sg5i5RJNfff4m5-m_UQJ8_VOFQTP1FuumOR3VbA@mail.gmail.com>
Date:	Thu, 14 Jun 2012 00:45:16 +0530
From:	Jassi Brar <jaswinder.singh@...aro.org>
To:	Javi Merino <javi.merino@....com>
Cc:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"dan.j.williams@...el.com" <dan.j.williams@...el.com>,
	"vinod.koul@...el.com" <vinod.koul@...el.com>
Subject: Re: [PATCH] DMA: PL330: Fix racy mutex unlock

On 14 June 2012 00:06, Javi Merino <javi.merino@....com> wrote:
>
> Ok, the description sucks.  Let me try to describe it with the scenario that
> failed:
>
> Core 0:
> - Two DMA transactions finish, in channels 0 and 1.
> - pl330_update() is called, the "Event-Interrupt Status Register" (ES)
>  is 0x3.
> - In the "for (ev = 0;..." loop
>  + two pointers are stored in pl330->req_done:
>    pl330->channels[0]->req[0] and pl330->channels[1]->req[0]
> - In the "while (!list_empty.." loop,
>  + r = pl330->channels[0]->req[0]->r
>  + Release the pl330_lock and call _callback()
>
> Core 1:
> - pl330_submit_req() for channel 1
> - Grab the pl330_lock
> - Hook a request in pl330->channels[1]->req[0]->r
> - Release the pl330_lock
>
> Core 0:
> - _callback() returns
> - Acquire the pl330_lock again
> - second iteration of "while (!list_empty.." loop,
>  + r = pl330->channels[1]->req[0]->r , but you get the r that has just
>    been scheduled, not the one that finished.
>
Thanks for detailed explanation of the bug.

I see, it's not safe across channels. Another option could be taking
channel's lock in update and submit.

Acked-by: Jassi Brar <jaswinder.singh@...aro.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/