linux-kernel - [PATCH v2 1/2] dmaengine: idxd: Protect int

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231031022017.1515471-2-guanjun@linux.alibaba.com>
Date:   Tue, 31 Oct 2023 10:20:16 +0800
From:   'Guanjun' <guanjun@...ux.alibaba.com>
To:     dave.jiang@...el.com, dmaengine@...r.kernel.org,
        linux-kernel@...r.kernel.org, vkoul@...nel.org,
        tony.luck@...el.com, fenghua.yu@...el.com
Cc:     jing.lin@...el.com, ashok.raj@...el.com, sanjay.k.kumar@...el.com,
        megha.dey@...el.com, jacob.jun.pan@...el.com, yi.l.liu@...el.com,
        tglx@...utronix.de
Subject: [PATCH v2 1/2] dmaengine: idxd: Protect int_handle field in hw descriptor

From: Guanjun <guanjun@...ux.alibaba.com>

The int_handle field in hw descriptor should also be protected
by wmb() before possibly triggering a DMA read.

Fixes: ec0d64231615 (dmaengine: idxd: embed irq_entry in idxd_wq struct)
Signed-off-by: Guanjun <guanjun@...ux.alibaba.com>
Reviewed-by: Dave Jiang <dave.jiang@...el.com>
Reviewed-by: Fenghua Yu <fenghua.yu@...el.com>
---
 drivers/dma/idxd/submit.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
index c01db23e3333..3f922518e3a5 100644
--- a/drivers/dma/idxd/submit.c
+++ b/drivers/dma/idxd/submit.c
@@ -182,13 +182,6 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
 
 	portal = idxd_wq_portal_addr(wq);
 
-	/*
-	 * The wmb() flushes writes to coherent DMA data before
-	 * possibly triggering a DMA read. The wmb() is necessary
-	 * even on UP because the recipient is a device.
-	 */
-	wmb();
-
 	/*
 	 * Pending the descriptor to the lockless list for the irq_entry
 	 * that we designated the descriptor to.
@@ -199,6 +192,13 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
 		llist_add(&desc->llnode, &ie->pending_llist);
 	}
 
+	/*
+	 * The wmb() flushes writes to coherent DMA data before
+	 * possibly triggering a DMA read. The wmb() is necessary
+	 * even on UP because the recipient is a device.
+	 */
+	wmb();
+
 	if (wq_dedicated(wq)) {
 		iosubmit_cmds512(portal, desc->hw, 1);
 	} else {
-- 
2.39.3