lkml.org 
[lkml]   [2021]   [Aug]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 5.10 16/98] dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
Hi!

> [ Upstream commit 7dd2dd4ff9f3abda601f22b9d01441a0869d20d7 ]
>
> When user calls dmaengine_terminate_sync, the driver will clean up any
> remaining descriptors for all the pending or active transfers that had
> previously been submitted. However, this might happen whilst the tasklet is
> invoking the DMA callback for the last finished transfer, so by the time it
> returns and takes over the channel's spinlock, the list of completed
> descriptors it was traversing is no longer valid. This leads to a
> read-after-free situation.
>
> Fix it by signalling whether a user-triggered termination has happened by
> means of a boolean variable.

I see the variable is cleared and tested under spinlock, but it is set
without any locking. Do we need to take the spinlock, too?

Best regards,
Pavel

> @@ -1049,6 +1051,13 @@ static void xilinx_dma_chan_desc_cleanup(struct xilinx_dma_chan *chan)
> /* Run any dependencies, then free the descriptor */
> dma_run_dependencies(&desc->async_tx);
> xilinx_dma_free_tx_descriptor(chan, desc);
> +
> + /*
> + * While we ran a callback the user called a terminate function,
> + * which takes care of cleaning up any remaining descriptors
> + */
> + if (chan->terminating)
> + break;
> }
>
> spin_unlock_irqrestore(&chan->lock, flags);
> @@ -1965,6 +1974,8 @@ static dma_cookie_t xilinx_dma_tx_submit(struct dma_async_tx_descriptor *tx)
> if (desc->cyclic)
> chan->cyclic = true;
>
> + chan->terminating = false;
> +
> spin_unlock_irqrestore(&chan->lock, flags);
>
> return cookie;
> @@ -2436,6 +2447,7 @@ static int xilinx_dma_terminate_all(struct dma_chan *dchan)
>
> xilinx_dma_chan_reset(chan);
> /* Remove and free all of the descriptors in the lists */
> + chan->terminating = true;
> xilinx_dma_free_descriptors(chan);
> chan->idle = true;
>

--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2021-08-25 10:05    [W:0.313 / U:1.604 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site