Guodong Xu a143545855
dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() ...
Add proper locking in mmp_pdma_residue() to prevent use-after-free when
accessing descriptor list and descriptor contents.
The race occurs when multiple threads call tx_status() while the tasklet
on another CPU is freeing completed descriptors:
CPU 0 CPU 1
----- -----
mmp_pdma_tx_status()
mmp_pdma_residue()
-> NO LOCK held
list_for_each_entry(sw, ..)
DMA interrupt
dma_do_tasklet()
-> spin_lock(&desc_lock)
list_move(sw->node, ...)
spin_unlock(&desc_lock)
| dma_pool_free(sw) <- FREED!
-> access sw->desc <- UAF!
This issue can be reproduced when running dmatest on the same channel with
multiple threads (threads_per_chan > 1).
Fix by protecting the chain_running list iteration and descriptor access
with the chan->desc_lock spinlock.
Signed-off-by: Juan Li <lijuan@linux.spacemit.com >
Signed-off-by: Guodong Xu <guodong@riscstar.com >
Link: https://patch.msgid.link/20251216-mmp-pdma-race-v1-1-976a224bb622@riscstar.com
Signed-off-by: Vinod Koul <vkoul@kernel.org >
2025-12-16 20:28:39 +05:30
2025-12-10 06:38:17 +09:00
2025-12-05 17:29:04 -08:00
2025-12-06 18:34:24 -08:00
2025-12-05 20:41:20 -08:00
2025-11-25 12:39:26 +01:00
2025-12-10 06:29:40 +09:00
2025-12-14 15:24:10 +12:00
2025-12-01 16:21:16 -05:00
2025-12-06 18:34:24 -08:00
2025-11-21 18:42:02 +00:00
2025-12-06 18:34:24 -08:00
2025-12-08 09:38:52 +09:00
2025-12-05 17:29:04 -08:00
2025-12-06 18:34:24 -08:00
2025-12-05 21:29:02 -08:00
2025-12-05 17:29:04 -08:00
2025-12-06 10:15:41 -08:00
2025-12-05 17:47:59 -08:00
2025-12-05 13:52:43 -08:00
2025-11-26 13:58:59 +09:00
2025-11-27 18:11:43 -08:00
2025-12-16 20:28:39 +05:30
2025-12-04 18:42:48 -08:00
2025-11-25 19:20:42 -08:00
2025-12-06 09:01:27 -08:00
2025-12-04 12:26:36 -08:00
2025-12-13 05:44:03 +12:00
2025-11-20 16:44:04 +01:00
2025-11-26 14:28:19 +01:00
2025-12-13 16:36:57 +12:00
2025-12-13 17:39:28 +12:00
2025-11-26 14:40:59 +01:00
2025-12-10 06:38:17 +09:00
2025-12-09 06:10:17 +09:00
2025-12-09 08:46:10 +09:00
2025-12-06 18:34:24 -08:00
2025-12-10 07:48:05 +09:00
2025-12-12 23:59:39 +01:00
2025-12-06 18:34:24 -08:00
2025-12-04 18:54:37 -08:00
2025-12-10 16:44:18 +09:00
2025-11-19 16:03:12 +02:00
2025-12-06 10:15:41 -08:00
2025-12-14 06:07:09 +12:00
2025-12-05 17:29:04 -08:00
2025-12-05 17:29:04 -08:00
2025-11-28 09:47:44 -06:00
2025-12-14 15:35:35 +12:00
2025-12-06 08:27:07 -08:00
2025-12-05 17:29:04 -08:00
2025-12-04 15:18:33 -08:00
2025-12-14 15:35:35 +12:00
2025-12-04 14:10:16 -08:00
2025-12-09 08:50:27 +09:00
2025-11-26 15:09:30 +01:00
2025-12-08 11:25:14 +09:00
2025-12-06 09:32:25 -08:00
2025-12-09 08:53:24 +09:00
2025-12-06 18:34:24 -08:00
2025-12-13 16:26:55 +12:00
2025-12-06 16:24:52 -08:00
2025-12-13 16:29:22 +12:00
2025-12-06 18:34:24 -08:00
2025-12-02 17:03:55 -08:00
2025-11-20 22:38:38 +05:30
2025-12-09 06:45:00 +09:00
2025-12-10 06:38:17 +09:00
2025-12-04 13:50:39 -08:00
2025-12-05 17:29:04 -08:00
2025-12-04 15:50:37 -08:00
2025-12-03 12:42:36 -08:00
2025-12-03 17:24:33 -08:00
2025-12-13 16:41:50 +12:00
2025-12-04 17:10:08 -08:00
2025-12-11 09:54:59 +09:00
2025-11-29 15:20:23 -06:00
2025-11-19 18:34:24 +00:00
2025-12-08 09:38:52 +09:00
2025-11-26 10:16:10 -06:00
2025-12-13 17:09:06 +12:00
2025-12-07 16:15:19 +01:00
2025-12-14 15:35:35 +12:00
2025-12-03 17:24:33 -08:00
2025-12-06 09:01:27 -08:00
2025-12-08 12:37:27 +05:30
2025-12-11 09:57:08 +09:00
2025-12-06 18:52:00 -08:00
2025-12-14 15:35:35 +12:00
2025-11-21 21:27:20 +01:00
2025-12-05 17:29:04 -08:00
2025-12-06 18:42:12 -08:00
2025-12-06 18:38:19 -08:00
2025-12-08 22:11:00 -05:00
2025-11-26 15:10:39 +01:00
2025-12-06 18:42:12 -08:00
2025-12-05 13:52:43 -08:00
2025-12-04 19:42:53 -08:00
2025-12-04 18:59:21 -08:00
2025-12-06 15:41:26 -08:00
2025-12-04 17:34:16 -08:00
2025-11-27 02:03:07 -05:00
2025-12-06 10:00:49 -08:00
2025-12-06 10:49:19 -08:00
2025-12-06 18:52:00 -08:00
2025-12-06 18:52:00 -08:00
a143545855