linux-kernel - Re: [PATCH] dma: zynqmp_dma: Initialize descriptor list after freeing during reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1330934e-342e-1e16-6451-d8952463119c@secom.com.pl>
Date:   Sat, 2 May 2020 15:00:06 +0200
From:   Rafał Hibner <rafal.hibner@...om.com.pl>
To:     Vinod Koul <vkoul@...nel.org>
Cc:     Appana Durga Kedareswara rao <appana.durga.rao@...inx.com>,
        Radhey Shyam Pandey <radhey.shyam.pandey@...inx.com>,
        Harini Katakam <harini.katakam@...inx.com>,
        Dan Williams <dan.j.williams@...el.com>,
        Michal Simek <michal.simek@...inx.com>,
        "open list:DMA GENERIC OFFLOAD ENGINE SUBSYSTEM" 
        <dmaengine@...r.kernel.org>,
        "moderated list:ARM/ZYNQ ARCHITECTURE" 
        <linux-arm-kernel@...ts.infradead.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] dma: zynqmp_dma: Initialize descriptor list after freeing
 during reset

Hello Vinod,

On 02.05.2020 14:32, Vinod Koul wrote:
> Would it not be better to use list_del_init() where we delete it rather
> than do the init here?
>

It is not a problem of list element itself not being initialized.
The problem is that during fault conditions (zynqmp_dma_reset) all
elements are moved to free list. List head however is not reinitialized.

In normal flow elements are removed by list_del and resubmitted to
free list with zynqmp_dma_free_descriptor.

static void zynqmp_dma_chan_desc_cleanup(struct zynqmp_dma_chan *chan)
{
    ...
    list_for_each_entry_safe(desc, next, &chan->done_list, node) {
        ...
        list_del(&desc->node);
        ...
        zynqmp_dma_free_descriptor(chan, desc);
    }
}

The zynqmp_dma_free_descriptor does not delete elements from the
list by itself.
I am not he author of this driver so I fixed it by
doing non intrusive changes.

Anyways, I do not see how using list_del_init would fix the bug.

Regards, Rafal