linux-kernel - [PATCH] mailbox: txdone_method shouldn't always be reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20171116053126.28640-1-bjorn.andersson@linaro.org>
Date:   Wed, 15 Nov 2017 21:31:26 -0800
From:   Bjorn Andersson <bjorn.andersson@...aro.org>
To:     Jassi Brar <jassisinghbrar@...il.com>,
        Sudeep Holla <sudeep.holla@....com>
Cc:     linux-kernel@...r.kernel.org, Alexey Klimov <alexey.klimov@....com>
Subject: [PATCH] mailbox: txdone_method shouldn't always be reset

A client that knows how to drive txdone would temporarily "upgrade" the
method to TXDONE_BY_ACK. But with the introduction of commit 33cd7123ac0ba
("mailbox: reset txdone_method TXDONE_BY_POLL if client knows_txdone")
there is no longer a distinction between a channel in "upgraded" state
or a channel for a controller that only supports TXDONE_BY_ACK. So upon
freeing the channel it will be "downgraded" to TXDONE_BY_POLL.

But a channel that operates with the txdone method of TXDONE_BY_POLL
requires that the controller implements the last_tx_done callback and
that the associated hrtimer was initialized when the controller was
registered.

So the core now relies on the fact that subsequent calls to
mbox_request_channel() "upgrades" the channel to TXDONE_BY_ACK or it
will dereference the non-initialized hrtimer.

The intention of commit 33cd7123ac0ba ("mailbox: reset txdone_method
TXDONE_BY_POLL if client knows_txdone") is to not restart the hrtimer
when the channel is in an "upgraded" state. So this patch reverts the
commit, in order to never leave the channel is a invalid state, and
instead only start the timer when we're in the "non-upgraded" POLL
state.

Fixes: 33cd7123ac0ba ("mailbox: reset txdone_method TXDONE_BY_POLL if client knows_txdone")
Signed-off-by: Bjorn Andersson <bjorn.andersson@...aro.org>
---
 drivers/mailbox/mailbox.c | 6 +++---
 drivers/mailbox/pcc.c     | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index 674b35f402f5..da8d666a8c56 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -85,7 +85,7 @@ static void msg_submit(struct mbox_chan *chan)
 exit:
 	spin_unlock_irqrestore(&chan->lock, flags);
 
-	if (!err && (chan->txdone_method & TXDONE_BY_POLL))
+	if (!err && chan->txdone_method == TXDONE_BY_POLL)
 		/* kick start the timer immediately to avoid delays */
 		hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
 }
@@ -351,7 +351,7 @@ struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index)
 	init_completion(&chan->tx_complete);
 
 	if (chan->txdone_method	== TXDONE_BY_POLL && cl->knows_txdone)
-		chan->txdone_method = TXDONE_BY_ACK;
+		chan->txdone_method |= TXDONE_BY_ACK;
 
 	spin_unlock_irqrestore(&chan->lock, flags);
 
@@ -418,7 +418,7 @@ void mbox_free_channel(struct mbox_chan *chan)
 	spin_lock_irqsave(&chan->lock, flags);
 	chan->cl = NULL;
 	chan->active_req = NULL;
-	if (chan->txdone_method == TXDONE_BY_ACK)
+	if (chan->txdone_method == (TXDONE_BY_POLL | TXDONE_BY_ACK))
 		chan->txdone_method = TXDONE_BY_POLL;
 
 	module_put(chan->mbox->dev->driver->owner);
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 3ef7f036ceea..e5a69679cfa2 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -265,7 +265,7 @@ struct mbox_chan *pcc_mbox_request_channel(struct mbox_client *cl,
 	init_completion(&chan->tx_complete);
 
 	if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
-		chan->txdone_method = TXDONE_BY_ACK;
+		chan->txdone_method |= TXDONE_BY_ACK;
 
 	spin_unlock_irqrestore(&chan->lock, flags);
 
@@ -311,7 +311,7 @@ void pcc_mbox_free_channel(struct mbox_chan *chan)
 	spin_lock_irqsave(&chan->lock, flags);
 	chan->cl = NULL;
 	chan->active_req = NULL;
-	if (chan->txdone_method == TXDONE_BY_ACK)
+	if (chan->txdone_method == (TXDONE_BY_POLL | TXDONE_BY_ACK))
 		chan->txdone_method = TXDONE_BY_POLL;
 
 	spin_unlock_irqrestore(&chan->lock, flags);
-- 
2.15.0