[lkml]   [2017]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectPossible race in spi-tegra114.ko
While searching for races in Linux kernel I've come across
drivers/spi/spi-tegra114.ko module. Here is the question that I came up
with while analysing results. Lines are given using the info from Linux

Consider the following case:
Thread 1: Thread 2:
-> request_threaded_irq
(spi-tegra114.c: line 1070)
------------interrupt comes------------- tegra_spi_isr_thread
-> handle_dma_based_xfer
dma_sync_single_for_cpu(tspi->dev, tspi->tx_dma_phys, ...)
(spi-tegra114.c: line 368)
-> tspi->tx_dma_phys = ...
(spi-tegra114.c: line 621 or 625)

If the situation above is feasible then the value of tspi->tx_dma_phys
(which is 0) is passed to dma_sync_single_for_cpu and further down the
callstack. This is probably not good.
Note that other fields of tspi structure can also be affected using the
similar templates.
Similar cases can occur also for tspi structure in
drivers/spi/spi-tegra20-slink.ko module and for tsd structure in
drivers/spi/spi-tegra20-sflash.ko module.
So the question is: is there a possibility of interrupt triggering
before the registration of master (spi-tegra114.c: line 1125) or a write
to tspi->def_command1_reg (spi-tegra114.c: line 1121)?

Thank you for your time.

-- Anton Volkov
Linux Verification Center, ISPRAS
e-mail: <>

 \ /
  Last update: 2017-07-24 14:31    [W:0.080 / U:2.132 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site