linux-kernel - [PATCH 7/7] dmaengine: stm32-dma: properly mask irq bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  8 Oct 2018 22:47:52 -0700
From:   "Joel Fernandes (Google)" <joel@...lfernandes.org>
To:     stable@...r.kernel.org
Cc:     Pierre Yves MORDRET <pierre-yves.mordret@...com>,
        Antonio Borneo <borneo.antonio@...il.com>,
        Vinod Koul <vinod.koul@...el.com>, gregkh@...uxfoundation.org,
        Alexandre Torgue <alexandre.torgue@...com>,
        Dan Williams <dan.j.williams@...el.com>,
        dmaengine@...r.kernel.org,
        "Joel Fernandes (Google)" <joel@...lfernandes.org>,
        linux-arm-kernel@...ts.infradead.org (moderated list:ARM/STM32
        ARCHITECTURE), linux-kernel@...r.kernel.org,
        Maxime Coquelin <mcoquelin.stm32@...il.com>
Subject: [PATCH 7/7] dmaengine: stm32-dma: properly mask irq bits

From: Pierre Yves MORDRET <pierre-yves.mordret@...com>

A single register of the controller holds the information for four dma
channels.
The functions stm32_dma_irq_status() don't mask the relevant bits after
the shift, thus adjacent channel's status is also reported in the returned
value.
Fixed by masking the value before returning it.

Similarly, the function stm32_dma_irq_clear() don't mask the input value
before shifting it, thus an incorrect input value could disable the
interrupts of adjacent channels.
Fixed by masking the input value before using it.

Signed-off-by: Pierre-Yves MORDRET <pierre-yves.mordret@...com>
Signed-off-by: Antonio Borneo <borneo.antonio@...il.com>
Signed-off-by: Vinod Koul <vinod.koul@...el.com>
---
 drivers/dma/stm32-dma.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c
index 05a2974cd2c0..8c5807362a25 100644
--- a/drivers/dma/stm32-dma.c
+++ b/drivers/dma/stm32-dma.c
@@ -38,6 +38,10 @@
 #define STM32_DMA_TEI			BIT(3) /* Transfer Error Interrupt */
 #define STM32_DMA_DMEI			BIT(2) /* Direct Mode Error Interrupt */
 #define STM32_DMA_FEI			BIT(0) /* FIFO Error Interrupt */
+#define STM32_DMA_MASKI			(STM32_DMA_TCI \
+					 | STM32_DMA_TEI \
+					 | STM32_DMA_DMEI \
+					 | STM32_DMA_FEI)
 
 /* DMA Stream x Configuration Register */
 #define STM32_DMA_SCR(x)		(0x0010 + 0x18 * (x)) /* x = 0..7 */
@@ -405,7 +409,7 @@ static u32 stm32_dma_irq_status(struct stm32_dma_chan *chan)
 
 	flags = dma_isr >> (((chan->id & 2) << 3) | ((chan->id & 1) * 6));
 
-	return flags;
+	return flags & STM32_DMA_MASKI;
 }
 
 static void stm32_dma_irq_clear(struct stm32_dma_chan *chan, u32 flags)
@@ -420,6 +424,7 @@ static void stm32_dma_irq_clear(struct stm32_dma_chan *chan, u32 flags)
 	 * If (ch % 4) is 2 or 3, left shift the mask by 16 bits.
 	 * If (ch % 4) is 1 or 3, additionally left shift the mask by 6 bits.
 	 */
+	flags &= STM32_DMA_MASKI;
 	dma_ifcr = flags << (((chan->id & 2) << 3) | ((chan->id & 1) * 6));
 
 	if (chan->id & 4)
-- 
2.19.0.605.g01d371f741-goog