linux-kernel - [PATCH] dmaengine: altera-msgdma: fix descriptors freeing logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Sep 2023 21:58:59 +0200
From:   Olivier Dautricourt <olivierdautricourt@...il.com>
To:     Vinod Koul <vkoul@...nel.org>, Stefan Roese <sr@...x.de>,
        Eric Schwarz <eas@...optimization.com>
Cc:     dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org,
        Olivier Dautricourt <olivierdautricourt@...il.com>
Subject: [PATCH] dmaengine: altera-msgdma: fix descriptors freeing logic

Sparse complains because we first take the lock in msgdma_tasklet -> move
locking to msgdma_chan_desc_cleanup.
In consequence, move calling of msgdma_chan_desc_cleanup outside of the
critical section of function msgdma_tasklet.

Use spin_unlock_irqsave/restore instead of just spinlock/unlock to keep
state of irqs while executing the callbacks.

Remove list_del call in msgdma_chan_desc_cleanup, this should be the role
of msgdma_free_descriptor. In consequence replace list_add_tail with
list_move_tail in msgdma_free_descriptor. This fixes the path:
msgdma_free_chan_resources -> msgdma_free_descriptors ->
msgdma_free_desc_list -> msgdma_free_descriptor
which does __not__ seems to free correctly the descriptors as firsts nodes
where not removed from the specified list.

Signed-off-by: Olivier Dautricourt <olivierdautricourt@...il.com>
---
Following Eric Schwarz comments on altera-msgdma driver not having some
of the fixes made to zynqmp-dma driver (which msgdma driver is based on):
This patch should address at least the spinlock part, it __has not__ been
tested yet so please don't accept it right away. I'm in the process of
getting a new hardware to test with. Meanwhile it is open to reviews
and even better if someone is able to test it.

 drivers/dma/altera-msgdma.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c
index 4153c2edb049..c39937bfcdf1 100644
--- a/drivers/dma/altera-msgdma.c
+++ b/drivers/dma/altera-msgdma.c
@@ -233,7 +233,7 @@ static void msgdma_free_descriptor(struct msgdma_device *mdev,
 	struct msgdma_sw_desc *child, *next;
 
 	mdev->desc_free_cnt++;
-	list_add_tail(&desc->node, &mdev->free_list);
+	list_move_tail(&desc->node, &mdev->free_list);
 	list_for_each_entry_safe(child, next, &desc->tx_list, node) {
 		mdev->desc_free_cnt++;
 		list_move_tail(&child->node, &mdev->free_list);
@@ -583,22 +583,25 @@ static void msgdma_issue_pending(struct dma_chan *chan)
 static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)
 {
 	struct msgdma_sw_desc *desc, *next;
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&mdev->lock, irqflags);
 
 	list_for_each_entry_safe(desc, next, &mdev->done_list, node) {
 		struct dmaengine_desc_callback cb;
 
-		list_del(&desc->node);
-
 		dmaengine_desc_get_callback(&desc->async_tx, &cb);
 		if (dmaengine_desc_callback_valid(&cb)) {
-			spin_unlock(&mdev->lock);
+			spin_unlock_irqrestore(&mdev->lock, irqflags);
 			dmaengine_desc_callback_invoke(&cb, NULL);
-			spin_lock(&mdev->lock);
+			spin_lock_irqsave(&mdev->lock, irqflags);
 		}
 
 		/* Run any dependencies, then free the descriptor */
 		msgdma_free_descriptor(mdev, desc);
 	}
+
+	spin_unlock_irqrestore(&mdev->lock, irqflags);
 }
 
 /**
@@ -713,10 +716,11 @@ static void msgdma_tasklet(struct tasklet_struct *t)
 		}
 
 		msgdma_complete_descriptor(mdev);
-		msgdma_chan_desc_cleanup(mdev);
 	}
 
 	spin_unlock_irqrestore(&mdev->lock, flags);
+
+	msgdma_chan_desc_cleanup(mdev);
 }
 
 /**
-- 
2.41.0