linux-kernel - [PATCH dmaengine-fixes 1/1] dmaengine: read completed cookie before used cookie

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <d0106d723f7455208f83e50522007fee7887e67e.1392419479.git.siva.krishna.kumar.reddy.yerramreddy@intel.com>
Date:	Fri, 14 Feb 2014 15:32:57 -0800
From:	Siva Yerramreddy <siva.krishna.kumar.reddy.yerramreddy@...el.com>
To:	Dan Williams <dan.j.williams@...el.com>,
	Vinod Koul <vinod.koul@...el.com>
Cc:	dmaengine@...r.kernel.org, Sudeep Dutt <sudeep.dutt@...el.com>,
	Nikhil Rao <nikhil.rao@...el.com>,
	Ashutosh Dixit <ashutosh.dixit@...el.com>,
	linux-kernel@...r.kernel.org,
	Russell King <rmk+kernel@....linux.org.uk>,
	Siva Yerramreddy <siva.krishna.kumar.reddy.yerramreddy@...el.com>
Subject: [PATCH dmaengine-fixes 1/1] dmaengine: read completed cookie before used cookie

When running dmatest with my yet-to-be submitted driver for the Intel MIC DMA
engine, dmatest detected "dma0chan3-copy5: result #8096161:completion busy
status with src_off=0x0 dst_off=0x0 len=0x40 (0)". This is caused by reading
the used cookie before the completed cookie in dma_cookie_status(),  if a DMA
request is submitted in between the two reads, and completes,  the completed
cookie will be newer than the used cookie value read previously.  Reversing
the order of reads ensures that the completed cookie is for a DMA request
older than the used cookie.

Reviewed-by: Ashutosh Dixit <ashutosh.dixit@...el.com>
Reviewed-by: Sudeep Dutt <sudeep.dutt@...el.com>
Reviewed-by: Nikhil Rao <nikhil.rao@...el.com>
Signed-off-by: Siva Yerramreddy <siva.krishna.kumar.reddy.yerramreddy@...el.com>
---
 drivers/dma/dmaengine.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/dmaengine.h b/drivers/dma/dmaengine.h
index 17f983a..4c96892 100644
--- a/drivers/dma/dmaengine.h
+++ b/drivers/dma/dmaengine.h
@@ -7,6 +7,7 @@
 
 #include <linux/bug.h>
 #include <linux/dmaengine.h>
+#include <asm/barrier.h>
 
 /**
  * dma_cookie_init - initialize the cookies for a DMA channel
@@ -69,8 +70,13 @@ static inline enum dma_status dma_cookie_status(struct dma_chan *chan,
 {
 	dma_cookie_t used, complete;
 
-	used = chan->cookie;
 	complete = chan->completed_cookie;
+	/*
+	 * If this order is not maintained, used can end up being older than
+	 * complete
+	 */
+	smp_rmb();
+	used = chan->cookie;
 	barrier();
 	if (state) {
 		state->last = complete;
-- 
1.8.2.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/