From: Greg Kroah-Hartman Date: Mon, 9 Mar 2020 20:18:28 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.216~37 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=661fce1cf4899fc31b03af4025eb4fa03d840d12;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: dmaengine-tegra-apb-fix-use-after-free.patch dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch --- diff --git a/queue-4.9/dmaengine-tegra-apb-fix-use-after-free.patch b/queue-4.9/dmaengine-tegra-apb-fix-use-after-free.patch new file mode 100644 index 00000000000..675ae6bed46 --- /dev/null +++ b/queue-4.9/dmaengine-tegra-apb-fix-use-after-free.patch @@ -0,0 +1,62 @@ +From 94788af4ed039476ff3527b0e6a12c1dc42cb022 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 9 Feb 2020 19:33:38 +0300 +Subject: dmaengine: tegra-apb: Fix use-after-free + +From: Dmitry Osipenko + +commit 94788af4ed039476ff3527b0e6a12c1dc42cb022 upstream. + +I was doing some experiments with I2C and noticed that Tegra APB DMA +driver crashes sometime after I2C DMA transfer termination. The crash +happens because tegra_dma_terminate_all() bails out immediately if pending +list is empty, and thus, it doesn't release the half-completed descriptors +which are getting re-used before ISR tasklet kicks-in. + + tegra-i2c 7000c400.i2c: DMA transfer timeout + elants_i2c 0-0010: elants_i2c_irq: failed to read data: -110 + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 142 at lib/list_debug.c:45 __list_del_entry_valid+0x45/0xac + list_del corruption, ddbaac44->next is LIST_POISON1 (00000100) + Modules linked in: + CPU: 0 PID: 142 Comm: kworker/0:2 Not tainted 5.5.0-rc2-next-20191220-00175-gc3605715758d-dirty #538 + Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) + Workqueue: events_freezable_power_ thermal_zone_device_check + [] (unwind_backtrace) from [] (show_stack+0x11/0x14) + [] (show_stack) from [] (dump_stack+0x85/0x94) + [] (dump_stack) from [] (__warn+0xc1/0xc4) + [] (__warn) from [] (warn_slowpath_fmt+0x61/0x78) + [] (warn_slowpath_fmt) from [] (__list_del_entry_valid+0x45/0xac) + [] (__list_del_entry_valid) from [] (tegra_dma_tasklet+0x5b/0x154) + [] (tegra_dma_tasklet) from [] (tasklet_action_common.constprop.0+0x41/0x7c) + [] (tasklet_action_common.constprop.0) from [] (__do_softirq+0xd3/0x2a8) + [] (__do_softirq) from [] (irq_exit+0x7b/0x98) + [] (irq_exit) from [] (__handle_domain_irq+0x45/0x80) + [] (__handle_domain_irq) from [] (gic_handle_irq+0x45/0x7c) + [] (gic_handle_irq) from [] (__irq_svc+0x65/0x94) + Exception stack(0xde2ebb90 to 0xde2ebbd8) + +Signed-off-by: Dmitry Osipenko +Acked-by: Jon Hunter +Cc: +Link: https://lore.kernel.org/r/20200209163356.6439-2-digetx@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/tegra20-apb-dma.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/dma/tegra20-apb-dma.c ++++ b/drivers/dma/tegra20-apb-dma.c +@@ -755,10 +755,6 @@ static int tegra_dma_terminate_all(struc + bool was_busy; + + spin_lock_irqsave(&tdc->lock, flags); +- if (list_empty(&tdc->pending_sg_req)) { +- spin_unlock_irqrestore(&tdc->lock, flags); +- return 0; +- } + + if (!tdc->busy) + goto skip_dma_stop; diff --git a/queue-4.9/dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch b/queue-4.9/dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch new file mode 100644 index 00000000000..e72a401be9b --- /dev/null +++ b/queue-4.9/dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch @@ -0,0 +1,37 @@ +From c33ee1301c393a241d6424e36eff1071811b1064 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 9 Feb 2020 19:33:39 +0300 +Subject: dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list + +From: Dmitry Osipenko + +commit c33ee1301c393a241d6424e36eff1071811b1064 upstream. + +The interrupt handler puts a half-completed DMA descriptor on a free list +and then schedules tasklet to process bottom half of the descriptor that +executes client's callback, this creates possibility to pick up the busy +descriptor from the free list. Thus, let's disallow descriptor's re-use +until it is fully processed. + +Signed-off-by: Dmitry Osipenko +Acked-by: Jon Hunter +Cc: +Link: https://lore.kernel.org/r/20200209163356.6439-3-digetx@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/tegra20-apb-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/tegra20-apb-dma.c ++++ b/drivers/dma/tegra20-apb-dma.c +@@ -288,7 +288,7 @@ static struct tegra_dma_desc *tegra_dma_ + + /* Do not allocate if desc are waiting for ack */ + list_for_each_entry(dma_desc, &tdc->free_dma_desc, node) { +- if (async_tx_test_ack(&dma_desc->txd)) { ++ if (async_tx_test_ack(&dma_desc->txd) && !dma_desc->cb_count) { + list_del(&dma_desc->node); + spin_unlock_irqrestore(&tdc->lock, flags); + dma_desc->txd.flags = 0; diff --git a/queue-4.9/series b/queue-4.9/series index 66c7f0f0ab1..0a7374d43bf 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -72,3 +72,5 @@ vt-selection-close-sel_buffer-race.patch vt-selection-push-console-lock-down.patch vt-selection-push-sel_lock-up.patch x86-pkeys-manually-set-x86_feature_ospke-to-preserve-existing-changes.patch +dmaengine-tegra-apb-fix-use-after-free.patch +dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch