linux-kernel - Re: [PATCH] dmaengine: imx-dma: fix wrong callback invoke

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 20 Jan 2019 16:22:57 +0530
From:   Vinod Koul <vkoul@...nel.org>
To:     Leonid Iziumtsev <leonid.iziumtsev@...il.com>,
        Fabio Estevam <festevam@...il.com>
Cc:     dmaengine@...r.kernel.org, Dan Williams <dan.j.williams@...el.com>,
        linux-kernel@...r.kernel.org, m.grzeschik@...gutronix.de
Subject: Re: [PATCH] dmaengine: imx-dma: fix wrong callback invoke

On 15-01-19, 17:15, Leonid Iziumtsev wrote:
> Once the "ld_queue" list is not empty, next descriptor will migrate
> into "ld_active" list. The "desc" variable will be overwritten
> during that transition. And later the dmaengine_desc_get_callback_invoke()
> will use it as an argument. As result we invoke wrong callback.
> 
> That behaviour was in place since:
> commit fcaaba6c7136 ("dmaengine: imx-dma: fix callback path in tasklet").
> But after commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job")
> things got worse, since possible delay between tasklet_schedule()
> from DMA irq handler and actual tasklet function execution got bigger.
> And that gave more time for new DMA request to be submitted and
> to be put into "ld_queue" list.
> 
> It has been noticed that DMA issue is causing problems for "mxc-mmc"
> driver. While stressing the system with heavy network traffic and
> writing/reading to/from sd card simultaneously the timeout may happen:
> 
> 10013000.sdhci: mxcmci_watchdog: read time out (status = 0x30004900)
> 
> That often lead to file system corruption.

This looks reasonable to me and I think should go to stable as well.
Fabio can we get some testing done on this patch

> 
> Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@...il.com>
> ---
>  drivers/dma/imx-dma.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
> index c2fff3f6c9ca..4a09af3cd546 100644
> --- a/drivers/dma/imx-dma.c
> +++ b/drivers/dma/imx-dma.c
> @@ -618,7 +618,7 @@ static void imxdma_tasklet(unsigned long data)
>  {
>  	struct imxdma_channel *imxdmac = (void *)data;
>  	struct imxdma_engine *imxdma = imxdmac->imxdma;
> -	struct imxdma_desc *desc;
> +	struct imxdma_desc *desc, *next_desc;
>  	unsigned long flags;
>  
>  	spin_lock_irqsave(&imxdma->lock, flags);
> @@ -648,10 +648,10 @@ static void imxdma_tasklet(unsigned long data)
>  	list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);
>  
>  	if (!list_empty(&imxdmac->ld_queue)) {
> -		desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
> -					node);
> +		next_desc = list_first_entry(&imxdmac->ld_queue,
> +					     struct imxdma_desc, node);
>  		list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
> -		if (imxdma_xfer_desc(desc) < 0)
> +		if (imxdma_xfer_desc(next_desc) < 0)
>  			dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
>  				 __func__, imxdmac->channel);
>  	}
> -- 
> 2.11.0

-- 
~Vinod