lkml.org 
[lkml]   [2020]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v4 01/14] dmaengine: tegra-apb: Fix use-after-free
    From
    Date

    On 14/01/2020 20:33, Dmitry Osipenko wrote:
    > 14.01.2020 18:09, Jon Hunter пишет:
    >>
    >> On 12/01/2020 17:29, Dmitry Osipenko wrote:
    >>> I was doing some experiments with I2C and noticed that Tegra APB DMA
    >>> driver crashes sometime after I2C DMA transfer termination. The crash
    >>> happens because tegra_dma_terminate_all() bails out immediately if pending
    >>> list is empty, thus it doesn't release the half-completed descriptors
    >>> which are getting re-used before ISR tasklet kicks-in.
    >>
    >> Can you elaborate a bit more on how these are getting re-used? What is
    >> the sequence of events which results in the panic? I believe that this
    >> was also reported in the past [0] and so I don't doubt there is an issue
    >> here, but would like to completely understand this.
    >>
    >> Thanks!
    >> Jon
    >>
    >> [0] https://lore.kernel.org/patchwork/patch/675349/
    >>
    >
    > In my case it happens in the touchscreen driver during of the
    > touchscreen's interrupt handling (in a threaded IRQ handler) + CPU is
    > under load and there is other interrupts activity. So what happens here
    > is that the TS driver issues one I2C transfer, which fails with
    > (apparently bogus) timeout (because DMA descriptor is completed and
    > removed from the pending list, but tasklet not executed yet), and then
    > TS immediately issues another I2C transfer that re-uses the
    > yet-incompleted descriptor. That's my understanding.

    OK, but what is the exact sequence that it allowing it to re-use the
    incompleted descriptor?

    Thanks
    Jon

    --
    nvpublic

    \
     
     \ /
      Last update: 2020-01-15 10:03    [W:3.978 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site