linux-kernel - [PATCH] dmaengine: virt-dma:fix vchan_dma_desc_free_list list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1703567717-71861-1-git-send-email-yi.shao@semidrive.com>
Date: Tue, 26 Dec 2023 13:15:17 +0800
From: "yi.shao" <yi.shao@...idrive.com>
To: <vkoul@...nel.org>
Cc: <dmaengine@...r.kernel.org>, <linux-kernel@...r.kernel.org>, 
	<yi.shao@...idrive.com>
Subject: [PATCH] dmaengine: virt-dma:fix vchan_dma_desc_free_list list_del corruption.

To resolve the race problem when terminating a cyclic transfer,
dmaengine calls vchan_terminate_vdesc() from the DMA terminate_all
function.

When configuring the CONFIG_DEBUG_LIST macro, it detects a list
corruption error in the vchan_dma_desc_free_list function, displaying
the following message: "[54.964702] list_del corruption. prev->next
should be ffffa0001395a0b8, but it was ffffa000180a7950".

This error occurs because the virt_dma_desc remains in the
vc->desc_issued list.To resolve this issue, the vchan_terminate_vdesc
function should remove the descriptor from vc->desc_issued and then
add it to vc->desc_terminated.

Signed-off-by: yi.shao <yi.shao@...idrive.com>
---
 drivers/dma/virt-dma.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/virt-dma.h b/drivers/dma/virt-dma.h
index e9f5250..eee97d2 100644
--- a/drivers/dma/virt-dma.h
+++ b/drivers/dma/virt-dma.h
@@ -146,6 +146,7 @@ static inline void vchan_terminate_vdesc(struct virt_dma_desc *vd)
 {
 	struct virt_dma_chan *vc = to_virt_chan(vd->tx.chan);
 
+	list_del(&vd->node);
 	list_add_tail(&vd->node, &vc->desc_terminated);
 
 	if (vc->cyclic == vd)
-- 
2.7.4
注意：本电子邮件或其任何附件属于南京芯驰半导体科技有限公司及其各分子公司（“芯驰科技”）所有。本电子邮件或任何附件仅供收件人或收件实体使用。本电子邮件或任何附件可能包含芯驰科技的机密信息。禁止任何未经授权使用、复制、传播或因依赖本电子邮件而采取或不采取的任何其他行动。如果您不是此电子邮件的预期收件人，请通过回复电子邮件通知发件人，并从您的系统中删除此邮件和任何附件。非常感谢。
Attention：This email or any attachments thereof belong to Nanjing Semidrive Technology Ltd and each of its affiliates and subsidiaries（"SemiDrive Group"）.This email or any attachments are intended only for use by the individual or entity to which it is addressed. This email or any attachments may contain confidential information of SemiDrive Group. Any unauthorized use, copying, dissemination or any other action taken or omitted to be taken in reliance upon this email is prohibited. If you are not the intended recipient(s) of this email，Please notify the sender by reply e-mail and delete the message and any attachments from your system. Thank you.