linux-kernel - Re: [PATCH] dmaengine: mmp_pdma: Fix race condition in mmp_pdma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <176590417885.422798.17247803206459718657.b4-ty@kernel.org>
Date: Tue, 16 Dec 2025 22:26:18 +0530
From: Vinod Koul <vkoul@...nel.org>
To: Yixun Lan <dlan@...too.org>, Guodong Xu <guodong@...cstar.com>
Cc: Alex Elder <elder@...cstar.com>, dmaengine@...r.kernel.org, 
 linux-kernel@...r.kernel.org, linux-riscv@...ts.infradead.org, 
 spacemit@...ts.linux.dev, Juan Li <lijuan@...ux.spacemit.com>
Subject: Re: [PATCH] dmaengine: mmp_pdma: Fix race condition in
 mmp_pdma_residue()


On Tue, 16 Dec 2025 22:10:06 +0800, Guodong Xu wrote:
> Add proper locking in mmp_pdma_residue() to prevent use-after-free when
> accessing descriptor list and descriptor contents.
> 
> The race occurs when multiple threads call tx_status() while the tasklet
> on another CPU is freeing completed descriptors:
> 
> CPU 0                              CPU 1
> -----                              -----
> mmp_pdma_tx_status()
> mmp_pdma_residue()
>   -> NO LOCK held
>      list_for_each_entry(sw, ..)
>                                    DMA interrupt
>                                    dma_do_tasklet()
>                                      -> spin_lock(&desc_lock)
>                                         list_move(sw->node, ...)
>                                         spin_unlock(&desc_lock)
>   |                                     dma_pool_free(sw) <- FREED!
>   -> access sw->desc <- UAF!
> 
> [...]

Applied, thanks!

[1/1] dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
      commit: a143545855bc2c6e1330f6f57ae375ac44af00a7

Best regards,
-- 
~Vinod