github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
36960edcc3
linux/drivers/dma
History
Paul Cercueil fd9079bdc2 dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status 
commit baf6fd97b1 upstream.

The jz4780_dma_tx_status() function would check if a channel's cookie
state was set to 'completed', and if not, it would enter the critical
section. However, in that time frame, the jz4780_dma_chan_irq() function
was able to set the cookie to 'completed', and clear the jzchan->vchan
pointer, which was deferenced in the critical section of the first
function.

Fix this race by checking the channel's cookie state after entering the
critical function and not before.

Fixes: d894fc6046 ("dmaengine: jz4780: add driver for the Ingenic JZ4780 DMA controller")
Cc: stable@vger.kernel.org # v4.0
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reported-by: Artur Rojek <contact@artur-rojek.eu>
Tested-by: Artur Rojek <contact@artur-rojek.eu>
Link: https://lore.kernel.org/r/20201004140307.885556-1-paul@crapouillou.net
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-05 11:08:50 +01:00
..
bestcomm
dw dmaengine: dw: platform: Switch to acpi_dma_controller_register() 2020-01-27 14:51:06 +01:00
dw-axi-dmac dmaengine: dw-axi-dmac: fix null dereference when pointer first is null 2019-06-25 11:35:55 +08:00
hsu dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" 2020-01-27 14:50:57 +01:00
ioat dmaengine: ioat setting ioat timeout as module parameter 2020-07-29 10:16:53 +02:00
ipu
mediatek dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails 2020-10-01 13:14:27 +02:00
ppc4xx
qcom dmaengine: qcom: bam_dma: Fix resource leak 2019-11-06 13:06:21 +01:00
sh dmaengine: rcar-dmac: set scatter/gather max segment size 2019-11-24 08:20:30 +01:00
ti dmaengine: ti: edma: fix missed failure handling 2020-01-27 14:51:22 +01:00
xilinx dmaengine: zynqmp_dma: fix burst length configuration 2020-10-01 13:14:30 +02:00
acpi-dma.c dmaengine: acpi: Put the CSRT table after using it 2020-09-17 13:45:24 +02:00
altera-msgdma.c
amba-pl08x.c
at_hdmac_regs.h
at_hdmac.c dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate() 2020-09-09 19:04:24 +02:00
at_xdmac.c dmaengine: at_xdmac: remove a stray bottom half unlock 2019-11-20 18:46:20 +01:00
bcm-sba-raid.c
bcm2835-dma.c dmaengine: bcm2835: Print error in case setting DMA mask fails 2019-10-05 13:09:34 +02:00
coh901318_lli.c
coh901318.c dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() 2020-03-11 14:15:12 +01:00
coh901318.h
dma-axi-dmac.c dmaengine: axi-dmac: Don't check the number of frames for alignment 2020-01-27 14:50:41 +01:00
dma-jz4740.c
dma-jz4780.c dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status 2020-11-05 11:08:50 +01:00
dmaengine.c dmaengine: Store module owner in dma_device struct 2020-02-24 08:34:44 +01:00
dmaengine.h
dmatest.c dmaengine: dmatest: Fix iteration non-stop logic 2020-05-06 08:13:32 +02:00
ep93xx_dma.c
fsl_raid.c
fsl_raid.h
fsl-edma.c dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler 2020-07-22 09:32:12 +02:00
fsldma.c
fsldma.h
idma64.c dmaengine: idma64: Use actual device for DMA transfers 2019-06-15 11:54:10 +02:00
idma64.h dmaengine: idma64: Use actual device for DMA transfers 2019-06-15 11:54:10 +02:00
img-mdc-dma.c
imx-dma.c dmaengine: imx-dma: fix warning comparison of distinct pointer types 2019-04-05 22:33:15 +02:00
imx-sdma.c dmaengine: imx-sdma: remove dma_slave_config direction usage and leave sdma_event_enable() 2020-03-11 14:15:08 +01:00
iop-adma.c dmaengine: iop-adma: use correct printk format strings 2019-10-05 13:09:42 +02:00
k3dma.c dmaengine: k3dma: Avoid null pointer traversal 2020-01-17 19:47:16 +01:00
Kconfig dmaengine: dma-jz4780: Don't depend on MACH_JZ4780 2019-11-20 18:46:16 +01:00
lpc18xx-dmamux.c
Makefile
mic_x100_dma.c
mic_x100_dma.h
mmp_pdma.c
mmp_tdma.c dmaengine: mmp_tdma: Reset channel error on release 2020-05-20 08:18:39 +02:00
moxart-dma.c
mpc512x_dma.c
mv_xor_v2.c
mv_xor.c dmaengine: mv_xor: Use correct device for DMA API 2020-01-27 14:50:24 +01:00
mv_xor.h
mxs-dma.c
nbpfaxi.c
of-dma.c dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling 2020-09-09 19:04:24 +02:00
owl-dma.c dmaengine: owl: Use correct lock in owl_dma_get_pchan() 2020-05-27 17:37:38 +02:00
pch_dma.c PCI: Move Rohm Vendor ID to generic list 2020-06-22 09:05:23 +02:00
pl330.c dmaengine: pl330: Fix burst length if burst size is smaller than bus width 2020-09-09 19:04:25 +02:00
pxa_dma.c
s3c24xx-dma.c
sa11x0-dma.c
sirf-dma.c
sprd-dma.c dmaengine: sprd: Fix the possible memory leak issue 2019-11-12 19:20:54 +01:00
st_fdma.c
st_fdma.h
ste_dma40_ll.c
ste_dma40_ll.h
ste_dma40.c dmaengine: ste_dma40: fix unneeded variable warning 2019-09-06 10:21:54 +02:00
stm32-dma.c dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all 2020-10-01 13:14:35 +02:00
stm32-dmamux.c
stm32-mdma.c dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all 2020-10-01 13:14:34 +02:00
sun4i-dma.c
sun6i-dma.c
tegra20-apb-dma.c dmaengine: tegra-apb: Prevent race conditions on channel's freeing 2020-10-01 13:14:35 +02:00
tegra210-adma.c dmaengine: tegra210-adma: Fix runtime PM imbalance on error 2020-07-29 10:16:52 +02:00
timb_dma.c dmaengine: timb_dma: Use proper enum in td_prep_slave_sg 2019-11-24 08:19:46 +01:00
TODO
txx9dmac.c
txx9dmac.h
virt-dma.c
virt-dma.h
xgene-dma.c
zx_dma.c