linux-kernel - [PATCH v1 1/1] spi: topcliff-pch: Prevent usage of potentially stale DMA device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220307173740.80996-1-andriy.shevchenko@linux.intel.com>
Date:   Mon,  7 Mar 2022 19:37:40 +0200
From:   Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To:     Mark Brown <broonie@...nel.org>, linux-spi@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     Wang Qing <wangqing@...o.com>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Christophe JAILLET <christophe.jaillet@...adoo.fr>
Subject: [PATCH v1 1/1] spi: topcliff-pch: Prevent usage of potentially stale DMA device

DMA device is expected to be available while SPI transfer is ongoing.

Prevent usage of potentially stale DMA device by keeping reference
count till the end of the transfer.

Fixes: 4d986ffa036a ("spi: add missing pci_dev_put() before return")
Reported-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
---
 drivers/spi/spi-topcliff-pch.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 8e1cc345810a..dfaa1d79a78b 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -103,6 +103,7 @@
 static int use_dma = 1;
 
 struct pch_spi_dma_ctrl {
+	struct pci_dev		*dma_dev;
 	struct dma_async_tx_descriptor	*desc_tx;
 	struct dma_async_tx_descriptor	*desc_rx;
 	struct pch_dma_slave		param_tx;
@@ -876,7 +877,6 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
 	if (!chan) {
 		dev_err(&data->master->dev,
 			"ERROR: dma_request_channel FAILS(Tx)\n");
-		data->use_dma = 0;
 		goto out;
 	}
 	dma->chan_tx = chan;
@@ -893,13 +893,15 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
 			"ERROR: dma_request_channel FAILS(Rx)\n");
 		dma_release_channel(dma->chan_tx);
 		dma->chan_tx = NULL;
-		data->use_dma = 0;
 		goto out;
 	}
 	dma->chan_rx = chan;
 
+	dma->dma_dev = dma_dev;
+	return;
 out:
 	pci_dev_put(dma_dev);
+	data->use_dma = 0;
 }
 
 static void pch_spi_release_dma(struct pch_spi_data *data)
@@ -915,6 +917,8 @@ static void pch_spi_release_dma(struct pch_spi_data *data)
 		dma_release_channel(dma->chan_rx);
 		dma->chan_rx = NULL;
 	}
+
+	pci_dev_put(dma->dma_dev);
 }
 
 static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
-- 
2.34.1