linux-kernel - [PATCH] dma: mmp-pdma: fix irq handler overwrite physical chan issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1423030563-2090-1-git-send-email-zhouqiao@marvell.com>
Date:	Wed, 4 Feb 2015 14:16:03 +0800
From:	Qiao Zhou <zhouqiao@...vell.com>
To:	<dan.j.williams@...el.com>, <vinod.koul@...el.com>,
	<dmaengine@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<zhangfei.gao@...aro.org>
CC:	Qiao Zhou <zhouqiao@...vell.com>
Subject: [PATCH] dma: mmp-pdma: fix irq handler overwrite physical chan issue

Some dma channels may be reserved for other purpose in other layer,
like secure driver in EL2/EL3. PDMA driver can see the interrupt
status, but it should not try to handle related interrupt, since it
doesn't belong to PDMA driver in kernel. These interrupts should be
handled by corresponding client/module.Otherwise, it will overwrite
illegal memory and cause unexpected issues, since pdma driver only
requests resources for pdma channels.

In PDMA driver, the reserved channels are at the end of total 32
channels. If we find interrupt bit index is not smaller than total
dma channels, we should ignore it.

Signed-off-by: Qiao Zhou <zhouqiao@...vell.com>
---
 drivers/dma/mmp_pdma.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index 8b8952f..68ab55f 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -219,6 +219,9 @@ static irqreturn_t mmp_pdma_int_handler(int irq, void *dev_id)

 	while (dint) {
 		i = __ffs(dint);
+		/* only handle interrupts belonging to pdma driver*/
+		if (i >= pdev->dma_channels)
+			break;
 		dint &= (dint - 1);
 		phy = &pdev->phy[i];
 		ret = mmp_pdma_chan_handler(irq, phy);
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/