linux-kernel - Re: [PATCH] mmc: pxamci: do not complete requests under host spinlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPDyKFrVLmZ=T3VuFmKn=PiVbv65NEhCsQNDV3YyFwp=Uz=EyQ@mail.gmail.com>
Date: Fri, 23 Jan 2026 12:58:34 +0100
From: Ulf Hansson <ulf.hansson@...aro.org>
To: Ahmet Sezgin Duran <ahmet@...ginduran.net>
Cc: linux-mmc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mmc: pxamci: do not complete requests under host spinlock

On Thu, 22 Jan 2026 at 19:03, Ulf Hansson <ulf.hansson@...aro.org> wrote:
>
> On Sat, 10 Jan 2026 at 15:44, Ahmet Sezgin Duran <ahmet@...ginduran.net> wrote:
> >
> > pxamci_dma_irq calls pxamci_data_done while holding host->lock, but
> > pxamci_data_done is also called from the IRQ handler without the
> > lock held and completes MMC requests.
> >
> > Calling into the MMC core under a spinlock breaks the locking contract
> > and may lead to re-entrancy issues.
> >
> > Drop the host lock before completing the request in the DMA error path.
> >
> > Found by Coverity: CID#1658802
> >
> > Signed-off-by: Ahmet Sezgin Duran <ahmet@...ginduran.net>
>
> Applied for next and by adding a stable-tag, thanks!

I was too quick here. Is this really a problem that you have tested or
just something that you believe is the right thing to do?

Other drivers are holding spinlocks too when they call the mmc core to
complete requests. In principle it depends on how the host implements
locking, whether it's fine or not. For pxamci, I think it should be
fine to keep the lock held as the core will only kick a completion
variable in this case.

That said, I am going to drop this

[...]

Kind regards
Uffe