From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sascha Hauer Subject: Re: [PATCH v2 5/5] mmc: mxcmmc: fix race conditions for host->req and host->data access Date: Tue, 2 Apr 2013 08:58:52 +0200 Message-ID: <20130402065852.GD1906@pengutronix.de> References: <1364768585-5177-1-git-send-email-agust@denx.de> <1364768585-5177-6-git-send-email-agust@denx.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <1364768585-5177-6-git-send-email-agust@denx.de> Sender: linux-mmc-owner@vger.kernel.org To: Anatolij Gustschin Cc: linux-mmc@vger.kernel.org, Chris Ball , Markus Pargmann , devicetree-discuss@lists.ozlabs.org List-Id: devicetree@vger.kernel.org On Mon, Apr 01, 2013 at 12:23:05AM +0200, Anatolij Gustschin wrote: > mxcmci_dma_callback() is invoked by DMA drivers in soft-irq > context and can be interrupted by the mxcmci_irq() interrupt > which can finish the mmc request or data transfer and set > host->req or host->data pointers to NULL. Then mxcmci_data_done() > crashes with a null pointer dereferences. Protect all accesses > to host->req and host->data by spin locks. > > Also check host->data pointer in mxcmci_watchdog() before > dereferencing it. > > Signed-off-by: Anatolij Gustschin This looks like a bugfix which should be first in this series. Sascha > --- > v2: > - only rebased > > drivers/mmc/host/mxcmmc.c | 31 ++++++++++++++++++++++++------- > 1 files changed, 24 insertions(+), 7 deletions(-) > > diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c > index 2861e0d..23deb2a 100644 > --- a/drivers/mmc/host/mxcmmc.c > +++ b/drivers/mmc/host/mxcmmc.c > @@ -694,24 +694,40 @@ static void mxcmci_datawork(struct work_struct *work) > > static void mxcmci_data_done(struct mxcmci_host *host, unsigned int stat) > { > - struct mmc_data *data = host->data; > + struct mmc_request *req; > int data_error; > + unsigned long flags; > + > + spin_lock_irqsave(&host->lock, flags); > > - if (!data) > + if (!host->data) { > + spin_unlock_irqrestore(&host->lock, flags); > return; > + } > + > + if (!host->req) { > + spin_unlock_irqrestore(&host->lock, flags); > + return; > + } > + > + req = host->req; > + if (!req->stop) > + host->req = NULL; /* we will handle finish req below */ > > data_error = mxcmci_finish_data(host, stat); > > + spin_unlock_irqrestore(&host->lock, flags); > + > mxcmci_read_response(host, stat); > host->cmd = NULL; > > - if (host->req->stop) { > - if (mxcmci_start_cmd(host, host->req->stop, 0)) { > - mxcmci_finish_request(host, host->req); > + if (req->stop) { > + if (mxcmci_start_cmd(host, req->stop, 0)) { > + mxcmci_finish_request(host, req); > return; > } > } else { > - mxcmci_finish_request(host, host->req); > + mxcmci_finish_request(host, req); > } > } > > @@ -1005,7 +1021,8 @@ static void mxcmci_watchdog(unsigned long data) > > /* Mark transfer as erroneus and inform the upper layers */ > > - host->data->error = -ETIMEDOUT; > + if (host->data) > + host->data->error = -ETIMEDOUT; > host->req = NULL; > host->cmd = NULL; > host->data = NULL; > -- > 1.7.5.4 > > -- Pengutronix e.K. | | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |