linux-kernel - [PATCH RFC 01/21] media: ti: j721e-csi2rx: Fix races while restarting DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240222-multistream-v1-1-1837ed916eeb@ti.com>
Date: Thu, 22 Feb 2024 17:01:17 +0530
From: Jai Luthra <j-luthra@...com>
To: Tomi Valkeinen <tomi.valkeinen@...asonboard.com>,
        Mauro Carvalho Chehab
	<mchehab@...nel.org>,
        Sakari Ailus <sakari.ailus@...ux.intel.com>,
        Hans
 Verkuil <hverkuil-cisco@...all.nl>,
        Vaishnav Achath <vaishnav.a@...com>,
        Maxime Ripard <mripard@...nel.org>, Rob Herring <robh@...nel.org>,
        Krzysztof
 Kozlowski <krzysztof.kozlowski+dt@...aro.org>,
        Conor Dooley
	<conor+dt@...nel.org>
CC: <linux-media@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <devicetree@...r.kernel.org>, Vignesh Raghavendra <vigneshr@...com>,
        Aradhya
 Bhatia <a-bhatia1@...com>, Devarsh Thakkar <devarsht@...com>,
        Changhuang
 Liang <changhuang.liang@...rfivetech.com>,
        Jack Zhu
	<jack.zhu@...rfivetech.com>,
        Julien Massot <julien.massot@...labora.com>,
        Jayshri Pawar <jpawar@...ence.com>, Jai Luthra <j-luthra@...com>
Subject: [PATCH RFC 01/21] media: ti: j721e-csi2rx: Fix races while
 restarting DMA

After the frame is submitted to DMA, it may happen that the submitted
list is not updated soon enough, and the DMA callback is triggered
before that.

This can lead to kernel crashes, so move everything in a single
lock/unlock section to prevent such races.

Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E")
Signed-off-by: Jai Luthra <j-luthra@...com>
---
 drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
index be47a4a24f97..e2cac8d73d78 100644
--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
+++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
@@ -810,15 +810,14 @@ static void ti_csi2rx_buffer_queue(struct vb2_buffer *vb)
 			dev_warn(csi->dev,
 				 "Failed to drain DMA. Next frame might be bogus\n");
 
+		spin_lock_irqsave(&dma->lock, flags);
 		ret = ti_csi2rx_start_dma(csi, buf);
 		if (ret) {
-			dev_err(csi->dev, "Failed to start DMA: %d\n", ret);
-			spin_lock_irqsave(&dma->lock, flags);
 			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
 			dma->state = TI_CSI2RX_DMA_IDLE;
 			spin_unlock_irqrestore(&dma->lock, flags);
+			dev_err(csi->dev, "Failed to start DMA: %d\n", ret);
 		} else {
-			spin_lock_irqsave(&dma->lock, flags);
 			list_add_tail(&buf->list, &dma->submitted);
 			spin_unlock_irqrestore(&dma->lock, flags);
 		}

-- 
2.43.0