linux-kernel - [PATCH] mmc: pxamci: do not complete requests under host spinlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260110144432.176015-1-ahmet@sezginduran.net>
Date: Sat, 10 Jan 2026 17:44:32 +0300
From: Ahmet Sezgin Duran <ahmet@...ginduran.net>
To: ulf.hansson@...aro.org
Cc: linux-mmc@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Ahmet Sezgin Duran <ahmet@...ginduran.net>
Subject: [PATCH] mmc: pxamci: do not complete requests under host spinlock

pxamci_dma_irq calls pxamci_data_done while holding host->lock, but
pxamci_data_done is also called from the IRQ handler without the
lock held and completes MMC requests.

Calling into the MMC core under a spinlock breaks the locking contract
and may lead to re-entrancy issues.

Drop the host lock before completing the request in the DMA error path.

Found by Coverity: CID#1658802

Signed-off-by: Ahmet Sezgin Duran <ahmet@...ginduran.net>
---
 drivers/mmc/host/pxamci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index b5ea058ed467..6cf65aca2449 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -551,7 +551,9 @@ static void pxamci_dma_irq(void *param)
 		pr_err("%s: DMA error on %s channel\n", mmc_hostname(host->mmc),
 			host->data->flags & MMC_DATA_READ ? "rx" : "tx");
 		host->data->error = -EIO;
+		spin_unlock_irqrestore(&host->lock, flags);
 		pxamci_data_done(host, 0);
+		return;
 	}
 
 out_unlock:
-- 
2.52.0