linux-kernel - [PATCH] staging: most: dim2: fix a race condition in complete_all

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260205160231.1543828-1-s9430939@naver.com>
Date: Fri,  6 Feb 2026 01:02:31 +0900
From: Minu Jin <s9430939@...er.com>
To: parthiban.veerasooran@...rochip.com,
	christian.gromm@...rochip.com,
	gregkh@...uxfoundation.org,
	dan.carpenter@...aro.org
Cc: linux-staging@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	Minu Jin <s9430939@...er.com>
Subject: [PATCH] staging: most: dim2: fix a race condition in complete_all_mbos()

The current implementation of complete_all_mbos() repeatedly acquires
and releases the spinlock in loop. This causes lock contention.

This patch refactors the function to use list_replace_init(), moving all
entries to a local list. This removes the loop-based locking approach
and significantly reduces lock contention.

Signed-off-by: Minu Jin <s9430939@...er.com>
---
 drivers/staging/most/dim2/dim2.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/drivers/staging/most/dim2/dim2.c b/drivers/staging/most/dim2/dim2.c
index 80af965356d0..fb54bb1a803f 100644
--- a/drivers/staging/most/dim2/dim2.c
+++ b/drivers/staging/most/dim2/dim2.c
@@ -415,20 +415,16 @@ static irqreturn_t dim2_ahb_isr(int irq, void *_dev)
  */
 static void complete_all_mbos(struct list_head *head)
 {
+	struct mbo *mbo, *mbo_tmp;
 	unsigned long flags;
-	struct mbo *mbo;
-
-	for (;;) {
-		spin_lock_irqsave(&dim_lock, flags);
-		if (list_empty(head)) {
-			spin_unlock_irqrestore(&dim_lock, flags);
-			break;
-		}
+	LIST_HEAD(del_list);
 
-		mbo = list_first_entry(head, struct mbo, list);
-		list_del(head->next);
-		spin_unlock_irqrestore(&dim_lock, flags);
+	spin_lock_irqsave(&dim_lock, flags);
+	list_replace_init(head, &del_list);
+	spin_unlock_irqrestore(&dim_lock, flags);
 
+	list_for_each_entry_safe(mbo, mbo_tmp, &del_list, list) {
+		list_del(&mbo->list);
 		mbo->processed_length = 0;
 		mbo->status = MBO_E_CLOSE;
 		mbo->complete(mbo);
-- 
2.43.0