linux-kernel - Re: [PATCH RESEND] dmaengine: milbeaut-hdmac: Fix potential deadlock on &mc->vc.lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJe_ZhcN7P7z_W9r5RZ6qA5qLRkXzC3cw7+Vj3GXGyw5HuFxgw@mail.gmail.com>
Date:   Wed, 16 Aug 2023 11:26:50 -0500
From:   Jassi Brar <jaswinder.singh@...aro.org>
To:     Chengfeng Ye <dg573847474@...il.com>
Cc:     vkoul@...nel.org, sugaya.taichi@...ionext.com,
        orito.takao@...ionext.com, len.baker@....com,
        dmaengine@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND] dmaengine: milbeaut-hdmac: Fix potential deadlock
 on &mc->vc.lock

On Wed, 26 Jul 2023 at 04:06, Chengfeng Ye <dg573847474@...il.com> wrote:
>
> As &mc->vc.lock is acquired by milbeaut_hdmac_interrupt() under irq
> context, other acquisition of the same lock under process context should
> disable irq, otherwise deadlock could happen if the irq preempts the
> execution of process context code while the lock is held in process context
> on the same CPU.
>
> milbeaut_hdmac_chan_config(), milbeaut_hdmac_chan_resume() and
> milbeaut_hdmac_chan_pause() are such callback functions not disable irq by
> default.
>
> Possible deadlock scenario:
> milbeaut_hdmac_chan_config()
>     -> spin_lock(&mc->vc.lock)
>         <hard interruption>
>         -> milbeaut_hdmac_interrupt()
>         -> spin_lock(&mc->vc.lock); (deadlock here)
>
> This flaw was found by an experimental static analysis tool I am developing
> for irq-related deadlock.
>
> The tentative patch fixes the potential deadlock by spin_lock_irqsave() in
> the three callback functions to disable irq while lock is held.
>
> Signed-off-by: Chengfeng Ye <dg573847474@...il.com>
> ---
>  drivers/dma/milbeaut-hdmac.c | 15 +++++++++------
>  1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/milbeaut-hdmac.c b/drivers/dma/milbeaut-hdmac.c
> index 1b0a95892627..6151c830ff6e 100644
> --- a/drivers/dma/milbeaut-hdmac.c
> +++ b/drivers/dma/milbeaut-hdmac.c
> @@ -214,10 +214,11 @@ milbeaut_hdmac_chan_config(struct dma_chan *chan, struct dma_slave_config *cfg)
>  {
>         struct virt_dma_chan *vc = to_virt_chan(chan);
>         struct milbeaut_hdmac_chan *mc = to_milbeaut_hdmac_chan(vc);
> +       unsigned long flags;
>
> -       spin_lock(&mc->vc.lock);
> +       spin_lock_irqsave(&mc->vc.lock, flags);
>
while at it, maybe also use vc->lock, instead of mc->vc.lock here and
in other two places, just like the rest of driver.

Acked-by: Jassi Brar <jaswinder.singh@...aro.org>

thanks.