From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8CF8C195986; Wed, 5 Jun 2024 11:52:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717588353; cv=none; b=WVQR2+vdf2e+Wg/jrfdfbck+iS4rETfKrB8JuxvEmiOnGgLhA3QKnfSboGxQvVUYZuhsnu4C8g09dxOVwHfb0LaEpRDgEyeVWtFKAl4clU8ZNDFwMRvbEYJ3SXjT8bOZqAhf1dGcmgFxuHKniePwoDpNKmsVmyGE9ljs9dQEyr0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717588353; c=relaxed/simple; bh=WSFEV7EqOZEm+4GY4b64xZ1PyCcWKV1DAGeXX1rrq3Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Q6VDrvIKIl0nQy4bIFAMuSXSqliNF0NYnxb+hD7xbdxQfHCKPMURfn6IhS8W+mgghnfeWpozP4FBVQFUmELzf2VDJZTcxzf+ojbZKdx7Zk1QBkJtWRjMNMiYJJ/UAKzeZBmDSTRE5Y69zJlMVXrQnChARF5AZdXJY75mgykZIQc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VHUTjQbZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VHUTjQbZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87689C3277B; Wed, 5 Jun 2024 11:52:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1717588353; bh=WSFEV7EqOZEm+4GY4b64xZ1PyCcWKV1DAGeXX1rrq3Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VHUTjQbZP0HZURTnuEWIOStZjNXwsYvmia5dQ4ePu4AlDim8dcXKmNh8xqEBrvj+3 4KLz70akqkmND38y23d02XyO1BnI6qOsntxfrTAQBqIZ27BbmQW6aB0dHyVOk4YdAu NO9jL0cNU8fbao3IIxbB1zaV3Ai+Ffl3BgYQnPNfS1GGl/+HYnR4jGgIsRxLxP7Xw4 e3s6wEBXlFO6jx7/xFC+yheOMLE2gDu4ko48MkDru+TAcdSXA+NyD1ZhO0RThH/iTk zOkEskjQSnSYxk+Q222teILEfeDnL5h58hIyYan7SJ/b70lew8E6OhTbzfdqlkbBBP KRDa+hPoy5Uyw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Joao Pinto , Joao Pinto , Vinod Koul , Sasha Levin , Eugeniy.Paltsev@synopsys.com, dmaengine@vger.kernel.org Subject: [PATCH AUTOSEL 6.6 04/20] Avoid hw_desc array overrun in dw-axi-dmac Date: Wed, 5 Jun 2024 07:51:47 -0400 Message-ID: <20240605115225.2963242-4-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240605115225.2963242-1-sashal@kernel.org> References: <20240605115225.2963242-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.6.32 Content-Transfer-Encoding: 8bit From: Joao Pinto [ Upstream commit 333e11bf47fa8d477db90e2900b1ed3c9ae9b697 ] I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put() handles the hw_desc considering the descs_allocated, this scenario would result in a kernel panic (hw_desc array will be overrun). To fix this, the proposal is to add a new member to the axi_dma_desc structure, where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in axi_desc_put() to handle the hw_desc array correctly. Additionally I propose to remove the axi_chan_start_first_queued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled). Signed-off-by: Joao Pinto Link: https://lore.kernel.org/r/1711536564-12919-1-git-send-email-jpinto@synopsys.com Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin --- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++---- drivers/dma/dw-axi-dmac/dw-axi-dmac.h | 1 + 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c index dd02f84e404d0..72fb40de58b3f 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c @@ -256,6 +256,7 @@ static struct axi_dma_desc *axi_desc_alloc(u32 num) kfree(desc); return NULL; } + desc->nr_hw_descs = num; return desc; } @@ -282,7 +283,7 @@ static struct axi_dma_lli *axi_desc_get(struct axi_dma_chan *chan, static void axi_desc_put(struct axi_dma_desc *desc) { struct axi_dma_chan *chan = desc->chan; - int count = atomic_read(&chan->descs_allocated); + int count = desc->nr_hw_descs; struct axi_dma_hw_desc *hw_desc; int descs_put; @@ -1093,9 +1094,6 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan) /* Remove the completed descriptor from issued list before completing */ list_del(&vd->node); vchan_cookie_complete(vd); - - /* Submit queued descriptors after processing the completed ones */ - axi_chan_start_first_queued(chan); } out: diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac.h b/drivers/dma/dw-axi-dmac/dw-axi-dmac.h index eb267cb24f670..8521530a34ec4 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac.h +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac.h @@ -104,6 +104,7 @@ struct axi_dma_desc { u32 completed_blocks; u32 length; u32 period_len; + u32 nr_hw_descs; }; struct axi_dma_chan_config { -- 2.43.0