linux-kernel - Re: [PATCH 09/15] dmaengine: img-mdc: Handle early status read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Jul 2018 17:06:54 +0530
From:   Vinod Koul <vinod.koul@...aro.org>
To:     Andreas Färber <afaerber@...e.de>
Cc:     linux-mips@...ux-mips.org, Ralf Baechle <ralf@...ux-mips.org>,
        Paul Burton <paul.burton@...s.com>,
        James Hogan <jhogan@...nel.org>, linux-kernel@...r.kernel.org,
        Damien Horsley <damien.horsley@...tec.com>,
        Dan Williams <dan.j.williams@...el.com>,
        dmaengine@...r.kernel.org
Subject: Re: [PATCH 09/15] dmaengine: img-mdc: Handle early status read

On 22-07-18, 23:20, Andreas Färber wrote:
> From: Damien Horsley <damien.horsley@...tec.com>
> 
> It is possible that mdc_tx_status may be called before the first
> node has been read from memory.
> 
> In this case, the residue value stored in the register is undefined.
> Return the transfer size instead.
> 
> Signed-off-by: Damien Horsley <damien.horsley@...tec.com>
> Signed-off-by: Andreas Färber <afaerber@...e.de>
> ---
>  drivers/dma/img-mdc-dma.c | 40 ++++++++++++++++++++++++----------------
>  1 file changed, 24 insertions(+), 16 deletions(-)
> 
> diff --git a/drivers/dma/img-mdc-dma.c b/drivers/dma/img-mdc-dma.c
> index 25cec9c243e1..0f2f0f52d83a 100644
> --- a/drivers/dma/img-mdc-dma.c
> +++ b/drivers/dma/img-mdc-dma.c
> @@ -621,25 +621,33 @@ static enum dma_status mdc_tx_status(struct dma_chan *chan,
>  			(MDC_CMDS_PROCESSED_CMDS_DONE_MASK + 1);
>  
>  		/*
> -		 * If the command loaded event hasn't been processed yet, then
> -		 * the difference above includes an extra command.
> +		 * If the first node has not yet been read from memory,
> +		 * the residue register value is undefined

so is this the case when transfer is not started ?

>  		 */
> -		if (!mdesc->cmd_loaded)
> -			cmds--;
> -		else
> -			cmds += mdesc->list_cmds_done;
> -
> -		bytes = mdesc->list_xfer_size;
> -		ldesc = mdesc->list;
> -		for (i = 0; i < cmds; i++) {
> -			bytes -= ldesc->xfer_size + 1;
> -			ldesc = ldesc->next_desc;
> -		}
> -		if (ldesc) {
> -			if (residue != MDC_TRANSFER_SIZE_MASK)
> -				bytes -= ldesc->xfer_size - residue;
> +		if (!mdesc->cmd_loaded && !cmds) {
> +			bytes = mdesc->list_xfer_size;
> +		} else {
> +			/*
> +			 * If the command loaded event hasn't been processed yet, then
> +			 * the difference above includes an extra command.
> +			 */
> +			if (!mdesc->cmd_loaded)
> +				cmds--;
>  			else
> +				cmds += mdesc->list_cmds_done;
> +
> +			bytes = mdesc->list_xfer_size;
> +			ldesc = mdesc->list;
> +			for (i = 0; i < cmds; i++) {
>  				bytes -= ldesc->xfer_size + 1;
> +				ldesc = ldesc->next_desc;
> +			}
> +			if (ldesc) {
> +				if (residue != MDC_TRANSFER_SIZE_MASK)
> +					bytes -= ldesc->xfer_size - residue;
> +				else
> +					bytes -= ldesc->xfer_size + 1;
> +			}
>  		}
>  	}
>  	spin_unlock_irqrestore(&mchan->vc.lock, flags);
> -- 
> 2.16.4

-- 
~Vinod