Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-23 12:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
559c59b238
linux/drivers/dma
History
Iago Abal 91539eb1fd dmaengine: pl330: fix double lock 
The static bug finder EBA (http://www.iagoabal.eu/eba/) reported the
following double-lock bug:

    Double lock:
    1. spin_lock_irqsave(pch->lock, flags) at pl330_free_chan_resources:2236;
    2. call to function `pl330_release_channel' immediately after;
    3. call to function `dma_pl330_rqcb' in line 1753;
    4. spin_lock_irqsave(pch->lock, flags) at dma_pl330_rqcb:1505.

I have fixed it as suggested by Marek Szyprowski.

First, I have replaced `pch->lock' with `pl330->lock' in functions
`pl330_alloc_chan_resources' and `pl330_free_chan_resources'. This avoids
the double-lock by acquiring a different lock than `dma_pl330_rqcb'.

NOTE that, as a result, `pl330_free_chan_resources' executes
`list_splice_tail_init' on `pch->work_list' under lock `pl330->lock',
whereas in the rest of the code `pch->work_list' is protected by
`pch->lock'. I don't know if this may cause race conditions. Similarly
`pch->cyclic' is written by `pl330_alloc_chan_resources' under
`pl330->lock' but read by `pl330_tx_submit' under `pch->lock'.

Second, I have removed locking from `pl330_request_channel' and
`pl330_release_channel' functions. Function `pl330_request_channel' is
only called from `pl330_alloc_chan_resources', so the lock is already
held. Function `pl330_release_channel' is called from
`pl330_free_chan_resources', which already holds the lock, and from
`pl330_del'. Function `pl330_del' is called in an error path of
`pl330_probe' and at the end of `pl330_remove', but I assume that there
cannot be concurrent accesses to the protected data at those points.

Signed-off-by: Iago Abal <mail@iagoabal.eu>
Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2017-01-25 15:35:11 +05:30
..
bestcomm dmaengine: NO_IRQ removal from powerpc-only drivers 2016-09-14 18:57:38 +05:30
dw dmaengine: dw: fix typo in Kconfig 2017-01-02 08:13:00 +05:30
hsu dmaengine: hsu: pci: switch to new API for IRQ allocation 2016-11-25 11:11:08 +05:30
ioat dmaengine: iota: ioat_alloc_chan_resources should not perform sleeping allocations. 2017-01-10 10:41:51 +05:30
ipu Merge branch 'topic/no_irq' into for-linus 2016-10-03 09:18:29 +05:30
ppc4xx Merge branch 'topic/unmap_cleanup' into for-linus 2016-10-03 09:36:11 +05:30
qcom dmaengine: qcom_hidma: autoload while probing ACPI 2016-11-23 09:47:32 +05:30
sh dmaengine: rcar-dmac: unmap slave resource when channel is freed 2017-01-13 12:14:28 +05:30
xilinx dmengine: xilinx_dma: convert callback to helper function 2016-08-08 08:11:43 +05:30
acpi-dma.c dmaengine: acpi-dma: align debug message with flow 2016-02-22 09:06:09 +05:30
amba-pl08x.c dmaengine: pl08x: Add support for the DMA slave map 2016-11-17 15:51:28 +05:30
at_hdmac_regs.h dmaengine: at_hdmac: use %pad format string for dma_addr_t 2015-11-16 09:21:05 +05:30
at_hdmac.c dmaengine: at_hdmac: move to dma_pool_zalloc 2016-12-08 21:24:17 +05:30
at_xdmac.c dmaengine: at_xdmac: don't restore unsaved status 2016-12-06 10:45:48 +05:30
bcm2835-dma.c dmaengine: bcm2835: fix 64-bit warning 2016-07-06 22:39:43 +05:30
coh901318_lli.c dmaengine: coh901318: use NULL for pointer initialization 2016-09-26 22:28:24 +05:30
coh901318.c Merge branch 'topic/err_reporting' into for-linus 2016-10-03 09:17:33 +05:30
coh901318.h
cppi41.c dmaengine: cppi41: Clean up pointless warnings 2017-01-25 11:30:50 +05:30
dma-axi-dmac.c dmaengine: axi-dmac: Return IRQ_NONE if no IRQs are pending 2016-07-01 22:56:41 +05:30
dma-jz4740.c dmaengine: jz4740: remove unused arch header 2016-09-26 22:25:57 +05:30
dma-jz4780.c Merge branch 'topic/compile_test' into for-linus 2016-10-03 09:16:03 +05:30
dmaengine.c dmaengine: device must have at least one channel 2016-08-22 11:49:07 +05:30
dmaengine.h dmaengine: add support to provide error result from a DMA transation 2016-08-08 08:11:42 +05:30
dmatest.c ktime: Cleanup ktime_set() usage 2016-12-25 17:21:22 +01:00
edma.c dmaengine updates for 4.10-rc1 2016-12-14 20:42:45 -08:00
ep93xx_dma.c Merge branch 'topic/err_reporting' into for-linus 2016-10-03 09:17:33 +05:30
fsl_raid.c dmaengine: fsl_raid: Fix module autoload 2016-11-14 08:35:13 +05:30
fsl_raid.h dmaengine: Driver support for FSL RaidEngine device. 2015-04-02 16:10:27 +05:30
fsl-edma.c dmaengine: fsl-edma: kill the tasklets upon exit 2016-07-16 20:19:00 +05:30
fsldma.c Merge branch 'topic/unmap_cleanup' into for-linus 2016-10-03 09:36:11 +05:30
fsldma.h
idma64.c dmaengine: idma64: clear LLP_[SD]_EN bits in last descriptor 2016-02-15 22:06:45 +05:30
idma64.h asm-generic changes for 4.6 2016-03-24 23:13:48 -07:00
img-mdc-dma.c dmaengine: img-mdc: remove unused ‘prev_phys’ 2016-12-12 22:25:22 +05:30
imx-dma.c dmaengine: imx-dma: convert callback to helper function 2016-08-08 08:11:39 +05:30
imx-sdma.c dmaengine: imx-sdma - correct the dma transfer residue calculation 2016-11-25 11:05:14 +05:30
iop-adma.c dmaengine: iop-adma: convert callback to helper function 2016-08-08 08:11:39 +05:30
k3dma.c dmaengine: k3dma: move to dma_pool_zalloc 2016-12-08 21:24:21 +05:30
Kconfig dmaengine updates for 4.10-rc1 2016-12-14 20:42:45 -08:00
lpc18xx-dmamux.c dmaengine: add driver for lpc18xx dmamux 2015-08-18 22:12:14 +05:30
Makefile dmaengine: st_fdma: Add STMicroelectronics FDMA engine driver support 2016-10-18 20:12:06 +05:30
mic_x100_dma.c dmaengine: mic_x100_dma: remove unused ‘data’ 2016-12-12 22:25:22 +05:30
mic_x100_dma.h dmaengine: Add an enum for the dmaengine alignment constraints 2015-08-05 10:53:52 +05:30
mmp_pdma.c dmaengine: mmp_pdma: convert callback to helper function 2016-08-08 08:11:39 +05:30
mmp_tdma.c Merge branch 'topic/err_reporting' into for-linus 2016-10-03 09:17:33 +05:30
moxart-dma.c dmaengine: moxart: remove NO_IRQ 2016-09-05 16:40:52 +05:30
mpc512x_dma.c Merge branch 'topic/err_reporting' into for-linus 2016-10-03 09:17:33 +05:30
mv_xor_v2.c dmaengine: mv_xor_v2: remove trailing whitespace 2016-07-12 10:10:00 +05:30
mv_xor.c dmaengine: mv_xor: use builtin_platform_driver 2016-11-25 11:47:39 +05:30
mv_xor.h dmaengine: mv_xor: Add support for scatter-gather DMA mode 2016-11-25 11:16:36 +05:30
mxs-dma.c Merge branch 'topic/no_irq' into for-linus 2016-10-03 09:18:29 +05:30
nbpfaxi.c dmaengine: nbpfaxi: add optional max-burst property for memory reads/writes 2016-11-14 10:07:58 +05:30
of-dma.c dmaengine: of_dma: approximate an average distribution 2016-05-14 13:34:10 +05:30
omap-dma.c dmaengine: omap-dma: Fix the port_window support 2017-01-10 11:08:01 +05:30
pch_dma.c dmaengine: pch_dma: remove unused ‘cookie’ 2016-12-12 22:25:22 +05:30
pl330.c dmaengine: pl330: fix double lock 2017-01-25 15:35:11 +05:30
pxa_dma.c Revert "dmaengine: pxa_dma: add support for legacy transition" 2016-10-18 20:14:32 +05:30
s3c24xx-dma.c dmaengine: s3c24xx: remove unused ‘cdata’ 2016-12-12 22:25:22 +05:30
sa11x0-dma.c dmaengine: sa11x0: use correct print specifiers for size_t 2016-09-26 22:29:26 +05:30
sirf-dma.c dmaengine: sirf-dma: remove unused ‘sdesc’ 2016-12-12 22:25:22 +05:30
st_fdma.c dmaengine: st_fdma: Fix the error return code in st_fdma_probe() 2016-10-19 22:29:33 +05:30
st_fdma.h dmaengine: st_fdma: Add STMicroelectronics FDMA driver header file 2016-10-18 20:12:06 +05:30
ste_dma40_ll.c dmaengine: ste_dma40_ll: make d40_width_to_bits static 2016-06-08 08:59:55 +05:30
ste_dma40_ll.h
ste_dma40.c Merge branch 'topic/ste_dma40' into for-linus 2016-10-03 09:35:55 +05:30
stm32-dma.c dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status 2017-01-02 09:28:52 +05:30
sun4i-dma.c remove lots of IS_ERR_VALUE abuses 2016-05-27 15:26:11 -07:00
sun6i-dma.c dmaengine: sun6i: fix the uninitialized value for v_lli 2016-11-25 11:49:38 +05:30
tegra20-apb-dma.c dmaengine: tegra20-apb-dma: convert callback to helper function 2016-08-08 08:11:41 +05:30
tegra210-adma.c dmaengine: tegra210-adma: Update driver to use of_pm_clk_add_clk 2016-08-22 11:55:05 +05:30
ti-dma-crossbar.c dmaengine: ti-dma-crossbar: Add some 'of_node_put()' in error path. 2017-01-02 10:37:26 +05:30
timb_dma.c dmaengine: timb_dma: convert callback to helper function 2016-08-08 08:11:41 +05:30
TODO
txx9dmac.c dmaengine: txx9dmac: convert callback to helper function 2016-08-08 08:11:41 +05:30
txx9dmac.h
virt-dma.c dmaengine: virt-dma: convert callback to helper function 2016-08-08 08:11:41 +05:30
virt-dma.h dmaengine: virt-dma: move function declarations 2016-10-01 11:41:39 +05:30
xgene-dma.c dmaengine: xgene-dma: move unmap to before callback 2016-08-08 08:11:43 +05:30
zx296702_dma.c dmaengine: zx296702_dma: Use dma_pool_zalloc 2016-11-30 08:50:40 +05:30