linux-kernel - Re: [PATCH] drivers/dma/dma-jz4780: Fix race condition between probe and irq handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Aug 2020 20:46:43 +0200
From:   Paul Cercueil <paul@...pouillou.net>
To:     Lars-Peter Clausen <lars@...afoo.de>
Cc:     madhuparnabhowmik10@...il.com, dan.j.williams@...el.com,
        vkoul@...nel.org, dmaengine@...r.kernel.org,
        linux-kernel@...r.kernel.org, andrianov@...ras.ru,
        ldv-project@...uxtesting.org
Subject: Re: [PATCH] drivers/dma/dma-jz4780: Fix race condition between probe
 and irq handler



Le jeu. 20 août 2020 à 20:23, Lars-Peter Clausen <lars@...afoo.de> a 
écrit :
> On 8/20/20 1:59 PM, Paul Cercueil wrote:
>> Hi,
>> 
>> Le dim. 16 août 2020 à 12:52, madhuparnabhowmik10@...il.com a 
>> écrit :
>>> From: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
>>> 
>>> In probe IRQ is requested before zchan->id is initialized which can 
>>> be
>>> read in the irq handler. Hence, shift request irq and enable clock 
>>> after
>>> other initializations complete. Here, enable clock part is not part 
>>> of
>>> the race, it is just shifted down after request_irq to keep the 
>>> error
>>> path same as before.
>>> 
>>> Found by Linux Driver Verification project (linuxtesting.org).
>>> 
>>> Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
>> 
>> I don't think there is a race at all, the interrupt handler won't be 
>> called before the DMA is registered.
>> 
> From a purely formal verification perspective there is a bug. The 
> interrupt could fire if i.e. the hardware is buggy or something. In 
> general it is a good idea to not request the IRQ until all the 
> resources that are used in the interrupt handler are properly set up. 
> Even if you know that in practice the interrupt will never fire this 
> early.
> 

Fair enough, I'm fine with that, but the patch should be reworked so 
that the clk_prepare_enable() call is not moved.

Cheers,
-Paul