linux-kernel - Re: [PATCH] dma: zynqmp_dma: Initialize descriptor list after freeing during reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200504051623.GE1375924@vkoul-mobl>
Date:   Mon, 4 May 2020 10:46:23 +0530
From:   Vinod Koul <vkoul@...nel.org>
To:     Rafał Hibner <rafal.hibner@...om.com.pl>
Cc:     Appana Durga Kedareswara rao <appana.durga.rao@...inx.com>,
        Radhey Shyam Pandey <radhey.shyam.pandey@...inx.com>,
        Harini Katakam <harini.katakam@...inx.com>,
        Dan Williams <dan.j.williams@...el.com>,
        Michal Simek <michal.simek@...inx.com>,
        "open list:DMA GENERIC OFFLOAD ENGINE SUBSYSTEM" 
        <dmaengine@...r.kernel.org>,
        "moderated list:ARM/ZYNQ ARCHITECTURE" 
        <linux-arm-kernel@...ts.infradead.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] dma: zynqmp_dma: Initialize descriptor list after
 freeing during reset

On 02-05-20, 15:00, Rafał Hibner wrote:
> Hello Vinod,
> 
> On 02.05.2020 14:32, Vinod Koul wrote:
> > Would it not be better to use list_del_init() where we delete it rather
> > than do the init here?
> >
> 
> It is not a problem of list element itself not being initialized.
> The problem is that during fault conditions (zynqmp_dma_reset) all
> elements are moved to free list. List head however is not reinitialized.
> 
> In normal flow elements are removed by list_del and resubmitted to
> free list with zynqmp_dma_free_descriptor.
> 
> static void zynqmp_dma_chan_desc_cleanup(struct zynqmp_dma_chan *chan)
> {
>     ...
>     list_for_each_entry_safe(desc, next, &chan->done_list, node) {
>         ...
>         list_del(&desc->node);
>         ...
>         zynqmp_dma_free_descriptor(chan, desc);
>     }
> }
> 
> The zynqmp_dma_free_descriptor does not delete elements from the
> list by itself.
> I am not he author of this driver so I fixed it by
> doing non intrusive changes.
> 
> Anyways, I do not see how using list_del_init would fix the bug.

Looking at this, i think it would make sense to do list_splice_init()
before we send the list to be freed.

Radhey/Appana are cced, they should test this.

-- 
~Vinod