2020-08-21 03:45:49

by Madhuparna Bhowmik

Subject: [PATCH v2] drivers/dma/dma-jz4780: Fix race condition between probe and irq handler

From: Madhuparna Bhowmik <[email protected]>

In probe, IRQ is requested before zchan->id is initialized which can be
read in the irq handler. Hence, shift request irq after other initializations
complete.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Madhuparna Bhowmik <[email protected]>

---
Changes since v1:
Keep enable clock before request IRQ.
---
drivers/dma/dma-jz4780.c | 38 +++++++++++++++++++-------------------
1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
index 448f663da89c..8beed91428bd 100644
--- a/drivers/dma/dma-jz4780.c
+++ b/drivers/dma/dma-jz4780.c
@@ -879,24 +879,11 @@ static int jz4780_dma_probe(struct platform_device *pdev)
return -EINVAL;
}

- ret = platform_get_irq(pdev, 0);
- if (ret < 0)
- return ret;
-
- jzdma->irq = ret;
-
- ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0, dev_name(dev),
- jzdma);
- if (ret) {
- dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
- return ret;
- }
-
jzdma->clk = devm_clk_get(dev, NULL);
if (IS_ERR(jzdma->clk)) {
dev_err(dev, "failed to get clock\n");
ret = PTR_ERR(jzdma->clk);
- goto err_free_irq;
+ return ret;
}

clk_prepare_enable(jzdma->clk);
@@ -949,10 +936,23 @@ static int jz4780_dma_probe(struct platform_device *pdev)
jzchan->vchan.desc_free = jz4780_dma_desc_free;
}

+ ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+ goto err_disable_clk;
+
+ jzdma->irq = ret;
+
+ ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0, dev_name(dev),
+ jzdma);
+ if (ret) {
+ dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
+ goto err_disable_clk;
+ }
+
ret = dmaenginem_async_device_register(dd);
if (ret) {
dev_err(dev, "failed to register device\n");
- goto err_disable_clk;
+ goto err_free_irq;
}

/* Register with OF DMA helpers. */
@@ -960,17 +960,17 @@ static int jz4780_dma_probe(struct platform_device *pdev)
jzdma);
if (ret) {
dev_err(dev, "failed to register OF DMA controller\n");
- goto err_disable_clk;
+ goto err_free_irq;
}

dev_info(dev, "JZ4780 DMA controller initialised\n");
return 0;

-err_disable_clk:
- clk_disable_unprepare(jzdma->clk);
-
err_free_irq:
free_irq(jzdma->irq, jzdma);
+
+err_disable_clk:
+ clk_disable_unprepare(jzdma->clk);
return ret;
}

--
2.17.1

2020-08-21 17:08:08

by Paul Cercueil

Subject: Re: [PATCH v2] drivers/dma/dma-jz4780: Fix race condition between probe and irq handler

Le ven. 21 ao?t 2020 ? 9:14, [email protected] a ?crit :
> From: Madhuparna Bhowmik <[email protected]>
>
> In probe, IRQ is requested before zchan->id is initialized which can
> be
> read in the irq handler. Hence, shift request irq after other
> initializations
> complete.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Madhuparna Bhowmik <[email protected]>

Reviewed-by: Paul Cercueil <[email protected]>

Thanks for the patch.

Cheers,
-Paul

>
> ---
> Changes since v1:
> Keep enable clock before request IRQ.
> ---
> drivers/dma/dma-jz4780.c | 38 +++++++++++++++++++-------------------
> 1 file changed, 19 insertions(+), 19 deletions(-)
>
> diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
> index 448f663da89c..8beed91428bd 100644
> --- a/drivers/dma/dma-jz4780.c
> +++ b/drivers/dma/dma-jz4780.c
> @@ -879,24 +879,11 @@ static int jz4780_dma_probe(struct
> platform_device *pdev)
> return -EINVAL;
> }
>
> - ret = platform_get_irq(pdev, 0);
> - if (ret < 0)
> - return ret;
> -
> - jzdma->irq = ret;
> -
> - ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0,
> dev_name(dev),
> - jzdma);
> - if (ret) {
> - dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
> - return ret;
> - }
> -
> jzdma->clk = devm_clk_get(dev, NULL);
> if (IS_ERR(jzdma->clk)) {
> dev_err(dev, "failed to get clock\n");
> ret = PTR_ERR(jzdma->clk);
> - goto err_free_irq;
> + return ret;
> }
>
> clk_prepare_enable(jzdma->clk);
> @@ -949,10 +936,23 @@ static int jz4780_dma_probe(struct
> platform_device *pdev)
> jzchan->vchan.desc_free = jz4780_dma_desc_free;
> }
>
> + ret = platform_get_irq(pdev, 0);
> + if (ret < 0)
> + goto err_disable_clk;
> +
> + jzdma->irq = ret;
> +
> + ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0,
> dev_name(dev),
> + jzdma);
> + if (ret) {
> + dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
> + goto err_disable_clk;
> + }
> +
> ret = dmaenginem_async_device_register(dd);
> if (ret) {
> dev_err(dev, "failed to register device\n");
> - goto err_disable_clk;
> + goto err_free_irq;
> }
>
> /* Register with OF DMA helpers. */
> @@ -960,17 +960,17 @@ static int jz4780_dma_probe(struct
> platform_device *pdev)
> jzdma);
> if (ret) {
> dev_err(dev, "failed to register OF DMA controller\n");
> - goto err_disable_clk;
> + goto err_free_irq;
> }
>
> dev_info(dev, "JZ4780 DMA controller initialised\n");
> return 0;
>
> -err_disable_clk:
> - clk_disable_unprepare(jzdma->clk);
> -
> err_free_irq:
> free_irq(jzdma->irq, jzdma);
> +
> +err_disable_clk:
> + clk_disable_unprepare(jzdma->clk);
> return ret;
> }
>
> --
> 2.17.1
>

2020-08-25 11:18:57

by Vinod Koul

Subject: Re: [PATCH v2] drivers/dma/dma-jz4780: Fix race condition between probe and irq handler

On 21-08-20, 09:14, [email protected] wrote:
> From: Madhuparna Bhowmik <[email protected]>
>
> In probe, IRQ is requested before zchan->id is initialized which can be
> read in the irq handler. Hence, shift request irq after other initializations
> complete.

Applied, thanks

--
~Vinod