linux-kernel - Re: [PATCH] dmaengine: imx-sdma: fix context cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200228124448.GA1689606@pcleri>
Date:   Fri, 28 Feb 2020 13:44:48 +0100
From:   Richard Leitner <richard.leitner@...data.com>
To:     Martin Fuzzey <martin.fuzzey@...wbird.group>
CC:     <dmaengine@...r.kernel.org>, <stable@...r.kernel.org>,
        Shawn Guo <shawnguo@...nel.org>,
        Sascha Hauer <s.hauer@...gutronix.de>,
        Fabio Estevam <festevam@...il.com>,
        NXP Linux Team <linux-imx@....com>,
        Robin Gong <yibin.gong@....com>,
        <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] dmaengine: imx-sdma: fix context cache

Hi,

On Wed, Jan 29, 2020 at 02:40:06PM +0100, Martin Fuzzey wrote:
> There is a DMA problem with the serial ports on i.MX6.
> 
> When the following sequence is performed:
> 
> 1) Open a port
> 2) Write some data
> 3) Close the port
> 4) Open a *different* port
> 5) Write some data
> 6) Close the port
> 
> The second write sends nothing and the second close hangs.
> If the first close() is omitted it works.
> 
> Adding logs to the the UART driver shows that the DMA is being setup but
> the callback is never invoked for the second write.
> 
> This used to work in 4.19.
> 
> Git bisect leads to:
> 	ad0d92d: "dmaengine: imx-sdma: refine to load context only once"
> 
> This commit adds a "context_loaded" flag used to avoid unnecessary context
> setups.
> However the flag is only reset in sdma_channel_terminate_work(),
> which is only invoked in a worker triggered by sdma_terminate_all() IF
> there is an active descriptor.
> 
> So, if no active descriptor remains when the channel is terminated, the
> flag is not reset and, when the channel is later reused the old context
> is used.
> 
> Fix the problem by always resetting the flag in sdma_free_chan_resources().
> 
> Fixes: ad0d92d: "dmaengine: imx-sdma: refine to load context only once"
> Cc: stable@...r.kernel.org
> Signed-off-by: Martin Fuzzey <martin.fuzzey@...wbird.group>
> 

Thanks for the patch!
We were chasing this issue for days and just found your patch as we were
preparing our (quite similar) solution for submission ;-)

I've successfully tested your patch on a custom i.MX6Solo board.
Therefore feel free to add

Tested-by: Richard Leitner <richard.leitner@...data.com>

regards;rl