github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-13 01:08:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
4ff840604a
linux/drivers/dma
History
Paul Cercueil fd9079bdc2 dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status 
commit baf6fd97b1 upstream.

The jz4780_dma_tx_status() function would check if a channel's cookie
state was set to 'completed', and if not, it would enter the critical
section. However, in that time frame, the jz4780_dma_chan_irq() function
was able to set the cookie to 'completed', and clear the jzchan->vchan
pointer, which was deferenced in the critical section of the first
function.

Fix this race by checking the channel's cookie state after entering the
critical function and not before.

Fixes: d894fc6046 ("dmaengine: jz4780: add driver for the Ingenic JZ4780 DMA controller")
Cc: stable@vger.kernel.org # v4.0
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reported-by: Artur Rojek <contact@artur-rojek.eu>
Tested-by: Artur Rojek <contact@artur-rojek.eu>
Link: https://lore.kernel.org/r/20201004140307.885556-1-paul@crapouillou.net
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-05 11:08:50 +01:00
..
bestcomm treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
dw dmaengine: dw: platform: Switch to acpi_dma_controller_register() 2020-01-27 14:51:06 +01:00
dw-axi-dmac dmaengine: dw-axi-dmac: fix null dereference when pointer first is null 2019-06-25 11:35:55 +08:00
hsu dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" 2020-01-27 14:50:57 +01:00
ioat dmaengine: ioat setting ioat timeout as module parameter 2020-07-29 10:16:53 +02:00
ipu treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
mediatek dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails 2020-10-01 13:14:27 +02:00
ppc4xx dmaengine: ppc4xx: fix off-by-one build failure 2018-11-13 11:08:41 -08:00
qcom dmaengine: qcom: bam_dma: Fix resource leak 2019-11-06 13:06:21 +01:00
sh dmaengine: rcar-dmac: set scatter/gather max segment size 2019-11-24 08:20:30 +01:00
ti dmaengine: ti: edma: fix missed failure handling 2020-01-27 14:51:22 +01:00
xilinx dmaengine: zynqmp_dma: fix burst length configuration 2020-10-01 13:14:30 +02:00
acpi-dma.c dmaengine: acpi: Put the CSRT table after using it 2020-09-17 13:45:24 +02:00
altera-msgdma.c dmaengine: altera: Use IRQ-safe spinlock calls in the error paths as well 2017-10-20 11:51:10 +05:30
amba-pl08x.c dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
at_hdmac_regs.h dmaengine: at_hdmac: Remove unnecessary 0x prefixes before %pad 2017-11-08 10:47:04 +05:30
at_hdmac.c dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate() 2020-09-09 19:04:24 +02:00
at_xdmac.c dmaengine: at_xdmac: remove a stray bottom half unlock 2019-11-20 18:46:20 +01:00
bcm-sba-raid.c treewide: Use struct_size() for devm_kmalloc() and friends 2018-06-06 11:15:43 -07:00
bcm2835-dma.c dmaengine: bcm2835: Print error in case setting DMA mask fails 2019-10-05 13:09:34 +02:00
coh901318_lli.c
coh901318.c dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() 2020-03-11 14:15:12 +01:00
coh901318.h
dma-axi-dmac.c dmaengine: axi-dmac: Don't check the number of frames for alignment 2020-01-27 14:50:41 +01:00
dma-jz4740.c dmaengine: jz4740: disable/unprepare clk if probe fails 2017-12-11 09:00:06 +05:30
dma-jz4780.c dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status 2020-11-05 11:08:50 +01:00
dmaengine.c dmaengine: Store module owner in dma_device struct 2020-02-24 08:34:44 +01:00
dmaengine.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dmatest.c dmaengine: dmatest: Fix iteration non-stop logic 2020-05-06 08:13:32 +02:00
ep93xx_dma.c headers: separate linux/mod_devicetable.h from linux/platform_device.h 2018-07-07 17:52:26 +02:00
fsl_raid.c dmaengine: fsl_raid: make of_device_ids const. 2017-06-29 09:25:28 +05:30
fsl_raid.h
fsl-edma.c dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler 2020-07-22 09:32:12 +02:00
fsldma.c dmaengine: fsldma: simplify getting .drvdata 2018-04-22 21:37:17 +05:30
fsldma.h dmaengine: fsldma: set BWC, DAHTS and SAHTS values correctly 2017-06-22 18:31:35 +05:30
idma64.c dmaengine: idma64: Use actual device for DMA transfers 2019-06-15 11:54:10 +02:00
idma64.h dmaengine: idma64: Use actual device for DMA transfers 2019-06-15 11:54:10 +02:00
img-mdc-dma.c dmaengine: img-mdc-dma: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
imx-dma.c dmaengine: imx-dma: fix warning comparison of distinct pointer types 2019-04-05 22:33:15 +02:00
imx-sdma.c dmaengine: imx-sdma: remove dma_slave_config direction usage and leave sdma_event_enable() 2020-03-11 14:15:08 +01:00
iop-adma.c dmaengine: iop-adma: use correct printk format strings 2019-10-05 13:09:42 +02:00
k3dma.c dmaengine: k3dma: Avoid null pointer traversal 2020-01-17 19:47:16 +01:00
Kconfig dmaengine: dma-jz4780: Don't depend on MACH_JZ4780 2019-11-20 18:46:16 +01:00
lpc18xx-dmamux.c
Makefile dmaengine: Add Actions Semi Owl family S900 DMA driver 2018-08-09 08:16:00 +05:30
mic_x100_dma.c dmaengine: mic_x100_dma: use devm_kzalloc to fix an issue 2018-08-27 11:16:04 +05:30
mic_x100_dma.h
mmp_pdma.c
mmp_tdma.c dmaengine: mmp_tdma: Reset channel error on release 2020-05-20 08:18:39 +02:00
moxart-dma.c treewide: Use struct_size() for kmalloc()-family 2018-06-06 11:15:43 -07:00
mpc512x_dma.c
mv_xor_v2.c dmaengine: mv_xor_v2: use {lower,upper}_32_bits to configure HW descriptor address 2018-07-25 17:53:22 +05:30
mv_xor.c dmaengine: mv_xor: Use correct device for DMA API 2020-01-27 14:50:24 +01:00
mv_xor.h
mxs-dma.c dmaengine: mxs-dma: Switch to SPDX identifier 2018-05-23 11:10:31 +05:30
nbpfaxi.c dmaengine: nbpfaxi: Mark expected switch fall-through 2018-07-09 17:01:35 +05:30
of-dma.c dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling 2020-09-09 19:04:24 +02:00
owl-dma.c dmaengine: owl: Use correct lock in owl_dma_get_pchan() 2020-05-27 17:37:38 +02:00
pch_dma.c PCI: Move Rohm Vendor ID to generic list 2020-06-22 09:05:23 +02:00
pl330.c dmaengine: pl330: Fix burst length if burst size is smaller than bus width 2020-09-09 19:04:25 +02:00
pxa_dma.c dmaengine: pxa: add a default requestor policy 2018-06-18 21:29:23 +02:00
s3c24xx-dma.c headers: separate linux/mod_devicetable.h from linux/platform_device.h 2018-07-07 17:52:26 +02:00
sa11x0-dma.c treewide: Use struct_size() for kmalloc()-family 2018-06-06 11:15:43 -07:00
sirf-dma.c
sprd-dma.c dmaengine: sprd: Fix the possible memory leak issue 2019-11-12 19:20:54 +01:00
st_fdma.c
st_fdma.h
ste_dma40_ll.c
ste_dma40_ll.h
ste_dma40.c dmaengine: ste_dma40: fix unneeded variable warning 2019-09-06 10:21:54 +02:00
stm32-dma.c dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all 2020-10-01 13:14:35 +02:00
stm32-dmamux.c dmaengine: stm32-dmamux: fix a potential buffer overflow 2018-03-22 10:51:35 +05:30
stm32-mdma.c dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all 2020-10-01 13:14:34 +02:00
sun4i-dma.c dmaengine: sun4i: fix invalid argument 2017-04-24 09:50:05 +05:30
sun6i-dma.c dmaengine: sun6i: Retrieve channel count/max request from devicetree 2017-10-23 11:44:03 +05:30
tegra20-apb-dma.c dmaengine: tegra-apb: Prevent race conditions on channel's freeing 2020-10-01 13:14:35 +02:00
tegra210-adma.c dmaengine: tegra210-adma: Fix runtime PM imbalance on error 2020-07-29 10:16:52 +02:00
timb_dma.c dmaengine: timb_dma: Use proper enum in td_prep_slave_sg 2019-11-24 08:19:46 +01:00
TODO
txx9dmac.c dmaengine: txx9dmac: simplify getting .drvdata 2018-04-22 21:38:06 +05:30
txx9dmac.h
virt-dma.c dmaengine: virt-dma: Add helper to free/reuse a descriptor 2017-12-04 22:33:51 +05:30
virt-dma.h dmaengine: virt-dma: Support for race free transfer termination 2017-12-04 22:33:51 +05:30
xgene-dma.c dmaengine: xgene-dma: remove unused xgene_dma_invalidate_buffer 2017-08-22 22:13:44 +05:30
zx_dma.c treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00