linux-kernel - Re: [PATCH] dmaengine: altera-msgdma: fix descriptors freeing logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Sep 2023 15:07:15 +0200
From:   Eric Schwarz <eas@...optimization.com>
To:     Olivier Dautricourt <olivierdautricourt@...il.com>
Cc:     dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org,
        Vinod Koul <vkoul@...nel.org>, Stefan Roese <sr@...x.de>
Subject: Re: [PATCH] dmaengine: altera-msgdma: fix descriptors freeing logic

Hello Olivier,

thanks for following up on my comment first. I really appreciate. - I 
don't have access to the hardware anymore, so I cannot test changes myself.

This patch addresses IMHO three fixes. - Shouldn't it be split up into 
three small junks so one could also later work w/ git bisect / separate 
ack's? - That way it is an all or nothing thing. Please regard this 
remark as cosmetics.

Am 20.09.2023 um 21:58 schrieb Olivier Dautricourt:
> Sparse complains because we first take the lock in msgdma_tasklet -> move
> locking to msgdma_chan_desc_cleanup.
> In consequence, move calling of msgdma_chan_desc_cleanup outside of the
> critical section of function msgdma_tasklet.
> 
> Use spin_unlock_irqsave/restore instead of just spinlock/unlock to keep
> state of irqs while executing the callbacks.

What about the locking in the IRQ handler msgdma_irq_handler() itself? - 
Shouldn't spin_unlock_irqsave/restore() be used there as well instead of 
just spinlock/unlock()?

> Remove list_del call in msgdma_chan_desc_cleanup, this should be the role
> of msgdma_free_descriptor. In consequence replace list_add_tail with
> list_move_tail in msgdma_free_descriptor. This fixes the path:
> msgdma_free_chan_resources -> msgdma_free_descriptors ->
> msgdma_free_desc_list -> msgdma_free_descriptor
> which does __not__ seems to free correctly the descriptors as firsts nodes
> where not removed from the specified list.
>
s/__not__/_not_/
s/seems/seem/
s/firsts/first/ => Actually I would omit it.
s/where/were/

"Fixes: <12 digits git hash> ("commit-message")" is missing [1] isn't it?

[1] 
https://www.kernel.org/doc/html/latest/process/submitting-patches.html#using-reported-by-tested-by-reviewed-by-suggested-by-and-fixes

> Signed-off-by: Olivier Dautricourt <olivierdautricourt@...il.com>
> ---
> Following Eric Schwarz comments on altera-msgdma driver not having some
> of the fixes made to zynqmp-dma driver (which msgdma driver is based on):
> This patch should address at least the spinlock part, it __has not__ been
> tested yet so please don't accept it right away. I'm in the process of
> getting a new hardware to test with. Meanwhile it is open to reviews
> and even better if someone is able to test it.
> 
>   drivers/dma/altera-msgdma.c | 16 ++++++++++------
>   1 file changed, 10 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c
> index 4153c2edb049..c39937bfcdf1 100644
> --- a/drivers/dma/altera-msgdma.c
> +++ b/drivers/dma/altera-msgdma.c
> @@ -233,7 +233,7 @@ static void msgdma_free_descriptor(struct msgdma_device *mdev,
>   	struct msgdma_sw_desc *child, *next;
>   
>   	mdev->desc_free_cnt++;
> -	list_add_tail(&desc->node, &mdev->free_list);
> +	list_move_tail(&desc->node, &mdev->free_list);
>   	list_for_each_entry_safe(child, next, &desc->tx_list, node) {
>   		mdev->desc_free_cnt++;
>   		list_move_tail(&child->node, &mdev->free_list);
> @@ -583,22 +583,25 @@ static void msgdma_issue_pending(struct dma_chan *chan)
>   static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)
>   {
>   	struct msgdma_sw_desc *desc, *next;
> +	unsigned long irqflags;
> +
> +	spin_lock_irqsave(&mdev->lock, irqflags);
>   
>   	list_for_each_entry_safe(desc, next, &mdev->done_list, node) {
>   		struct dmaengine_desc_callback cb;
>   
> -		list_del(&desc->node);
> -
>   		dmaengine_desc_get_callback(&desc->async_tx, &cb);
>   		if (dmaengine_desc_callback_valid(&cb)) {
> -			spin_unlock(&mdev->lock);
> +			spin_unlock_irqrestore(&mdev->lock, irqflags);
>   			dmaengine_desc_callback_invoke(&cb, NULL);
> -			spin_lock(&mdev->lock);
> +			spin_lock_irqsave(&mdev->lock, irqflags);
>   		}
>   
>   		/* Run any dependencies, then free the descriptor */
>   		msgdma_free_descriptor(mdev, desc);
>   	}
> +
> +	spin_unlock_irqrestore(&mdev->lock, irqflags);
>   }
>   
>   /**
> @@ -713,10 +716,11 @@ static void msgdma_tasklet(struct tasklet_struct *t)
>   		}
>   
>   		msgdma_complete_descriptor(mdev);
> -		msgdma_chan_desc_cleanup(mdev);
>   	}
>   
>   	spin_unlock_irqrestore(&mdev->lock, flags);
> +
> +	msgdma_chan_desc_cleanup(mdev);
>   }
>   
>   /**