linux-kernel - [PATCH 2/2] bus: mhi: core: Fix double lock of 'mhi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200413120741.2832-2-manivannan.sadhasivam@linaro.org>
Date:   Mon, 13 Apr 2020 17:37:41 +0530
From:   Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
To:     hemantk@...eaurora.org, jhugo@...eaurora.org
Cc:     linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org,
        smohanad@...eaurora.org, dan.carpenter@...cle.com,
        Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
Subject: [PATCH 2/2] bus: mhi: core: Fix double lock of 'mhi_chan->lock'

mhi_queue_buf() will grab the 'mhi_chan->lock' for doing the doorbell
access. Hence the lock needs to be dropped before the call.

Fixes: 189ff97cca53 ("bus: mhi: core: Add support for data transfer")
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
---
 drivers/bus/mhi/core/main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c
index 4165a853c189..ed995137c3a0 100644
--- a/drivers/bus/mhi/core/main.c
+++ b/drivers/bus/mhi/core/main.c
@@ -538,6 +538,11 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl,
 			 * from dropping the packet
 			 */
 			if (mhi_chan->pre_alloc) {
+				/*
+				 * mhi_queue_buf() will grab the mhi_chan->lock
+				 * so let's drop it here and grab it later
+				 */
+				read_unlock_bh(&mhi_chan->lock);
 				if (mhi_queue_buf(mhi_chan->mhi_dev,
 						  mhi_chan->dir,
 						  buf_info->cb_buf,
@@ -547,6 +552,7 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl,
 						mhi_chan->chan);
 					kfree(buf_info->cb_buf);
 				}
+				read_lock_bh(&mhi_chan->lock);
 			}
 		}
 		break;
-- 
2.17.1