linux-kernel - [PATCH 090/145] dma: tegra: avoid channel lock up after free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 17 Jul 2013 15:47:02 -0700
From:	Kamal Mostafa <kamal@...onical.com>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	kernel-team@...ts.ubuntu.com
Cc:	Dmitry Osipenko <digetx@...il.com>,
	Vinod Koul <vinod.koul@...el.com>,
	Jonghwan Choi <jhbird.choi@...sung.com>,
	Luis Henriques <luis.henriques@...onical.com>
Subject: [PATCH 090/145] dma: tegra: avoid channel lock up after free

3.8.13.5 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Osipenko <digetx@...il.com>

commit 7bdc1e272a471062e8f310137c896e2355b46d13 upstream.

Lock scenario: Channel 1 was allocated and prepared as slave_sg, used and freed.
Now preparation of cyclic dma on channel 1 will fail with err "DMA configuration
conflict" because tdc->isr_handler still setted to handle_once_dma_done.

This happens because tegra_dma_abort_all() won't be called on channel freeing
if pending list is empty and channel not busy. We need to clear isr_handler
on channel freeing to avoid locking.

Signed-off-by: Dmitry Osipenko <digetx@...il.com>
Acked-by: Stephen Warren <swarren@...dia.com>
Acked-by: Laxman Dewangan <ldewangan@...dia.com>
Signed-off-by: Vinod Koul <vinod.koul@...el.com>
Cc: Jonghwan Choi <jhbird.choi@...sung.com>
Signed-off-by: Luis Henriques <luis.henriques@...onical.com>
---
 drivers/dma/tegra20-apb-dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index 3cad856..b9e32fe 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -1158,6 +1158,7 @@ static void tegra_dma_free_chan_resources(struct dma_chan *dc)
 	list_splice_init(&tdc->free_dma_desc, &dma_desc_list);
 	INIT_LIST_HEAD(&tdc->cb_desc);
 	tdc->config_init = false;
+	tdc->isr_handler = NULL;
 	spin_unlock_irqrestore(&tdc->lock, flags);
 
 	while (!list_empty(&dma_desc_list)) {
-- 
1.8.1.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/