linux-kernel - Re: [PATCH] drivers/dma/dma-jz4780: Fix race condition between probe and irq handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Aug 2020 20:23:35 +0200
From:   Lars-Peter Clausen <lars@...afoo.de>
To:     Paul Cercueil <paul@...pouillou.net>, madhuparnabhowmik10@...il.com
Cc:     dan.j.williams@...el.com, vkoul@...nel.org,
        dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org,
        andrianov@...ras.ru, ldv-project@...uxtesting.org
Subject: Re: [PATCH] drivers/dma/dma-jz4780: Fix race condition between probe
 and irq handler

On 8/20/20 1:59 PM, Paul Cercueil wrote:
> Hi,
>
> Le dim. 16 août 2020 à 12:52, madhuparnabhowmik10@...il.com a écrit :
>> From: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
>>
>> In probe IRQ is requested before zchan->id is initialized which can be
>> read in the irq handler. Hence, shift request irq and enable clock after
>> other initializations complete. Here, enable clock part is not part of
>> the race, it is just shifted down after request_irq to keep the error
>> path same as before.
>>
>> Found by Linux Driver Verification project (linuxtesting.org).
>>
>> Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
>
> I don't think there is a race at all, the interrupt handler won't be 
> called before the DMA is registered.
>
 From a purely formal verification perspective there is a bug. The 
interrupt could fire if i.e. the hardware is buggy or something. In 
general it is a good idea to not request the IRQ until all the resources 
that are used in the interrupt handler are properly set up. Even if you 
know that in practice the interrupt will never fire this early.