All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2 1/1] mmc: cqhci: fix random crash when remove mmc module
@ 2021-03-03 17:42 Frank Li
  2021-03-03 17:49 ` Adrian Hunter
  2021-03-04 13:50 ` Ulf Hansson
  0 siblings, 2 replies; 3+ messages in thread
From: Frank Li @ 2021-03-03 17:42 UTC (permalink / raw)
  To: lznuaa, adrian.hunter, riteshh, asutoshd, ulf.hansson, linux-mmc,
	linux-kernel, haibo.chen

[ 6684.493350] Unable to handle kernel paging request at virtual address ffff800011c5b0f0
[ 6684.498531] mmc0: card 0001 removed
[ 6684.501556] Mem abort info:
[ 6684.509681]   ESR = 0x96000047
[ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
[ 6684.518394]   SET = 0, FnV = 0
[ 6684.521707]   EA = 0, S1PTW = 0
[ 6684.524998] Data abort info:
[ 6684.528236]   ISV = 0, ISS = 0x00000047
[ 6684.532986]   CM = 0, WnR = 1
[ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081b22000
[ 6684.543923] [ffff800011c5b0f0] pgd=00000000bffff003, p4d=00000000bffff003, pud=00000000bfffe003, pmd=00000000900e1003, pte=0000000000000000
[ 6684.557915] Internal error: Oops: 96000047 [#1] PREEMPT SMP
[ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core]
[ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 5.10.9-01410-g3ba33182767b-dirty #10
[ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
[ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn

[ 6684.606094] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
[ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci]
[ 6684.626734] sp : ffff80001243b9f0
[ 6684.630049] x29: ffff80001243b9f0 x28: ffff00002c3dd000
[ 6684.635367] x27: 0000000000000001 x26: 0000000000000001
[ 6684.640690] x25: ffff00002c451000 x24: 000000000000000f
[ 6684.646007] x23: ffff000017e71c80 x22: ffff00002c451000
[ 6684.651326] x21: ffff00002c0f3550 x20: ffff00002c0f3550
[ 6684.656651] x19: ffff000017d46880 x18: ffff00002cea1500
[ 6684.661977] x17: 0000000000000000 x16: 0000000000000000
[ 6684.667294] x15: 000001ee628e3ed1 x14: 0000000000000278
[ 6684.672610] x13: 0000000000000001 x12: 0000000000000001
[ 6684.677927] x11: 0000000000000000 x10: 0000000000000000
[ 6684.683243] x9 : 000000000000002b x8 : 0000000000001000
[ 6684.688560] x7 : 0000000000000010 x6 : ffff00002c0f3678
[ 6684.693886] x5 : 000000000000000f x4 : ffff800011c5b000
[ 6684.699211] x3 : 000000000002d988 x2 : 0000000000000008
[ 6684.704537] x1 : 00000000000000f0 x0 : 0002d9880008102f
[ 6684.709854] Call trace:
[ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
[ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
[ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
[ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]

cqhci_request was called after cqhci_disable.

cqhci_disable                                 cqhci_request
{                                             {
	dmam_free_coherent();  (1) free
                                                  if(!cq_host->enable)
                                                       return
				         (2) pass check here
	cq_host->enable = false;

                                                  task_desc= get_desc(cq_host,tag);
                                                             ^^^^ crash here
                                         (3) access memory which is already free

}                                             }

Signed-off-by: Frank Li <Frank.Li@nxp.com>
---

Change from v1 to v2
 - use Adrian Hunter suggested method to fix this problem

 drivers/mmc/core/bus.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index c2e70b757dd1..4383c262b3f5 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -399,11 +399,6 @@ void mmc_remove_card(struct mmc_card *card)
 	mmc_remove_card_debugfs(card);
 #endif
 
-	if (host->cqe_enabled) {
-		host->cqe_ops->cqe_disable(host);
-		host->cqe_enabled = false;
-	}
-
 	if (mmc_card_present(card)) {
 		if (mmc_host_is_spi(card->host)) {
 			pr_info("%s: SPI card removed\n",
@@ -416,6 +411,10 @@ void mmc_remove_card(struct mmc_card *card)
 		of_node_put(card->dev.of_node);
 	}
 
+	if (host->cqe_enabled) {
+		host->cqe_ops->cqe_disable(host);
+		host->cqe_enabled = false;
+	}
+
 	put_device(&card->dev);
 }
-
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH v2 1/1] mmc: cqhci: fix random crash when remove mmc module
  2021-03-03 17:42 [PATCH v2 1/1] mmc: cqhci: fix random crash when remove mmc module Frank Li
@ 2021-03-03 17:49 ` Adrian Hunter
  2021-03-04 13:50 ` Ulf Hansson
  1 sibling, 0 replies; 3+ messages in thread
From: Adrian Hunter @ 2021-03-03 17:49 UTC (permalink / raw)
  To: Frank Li, asutoshd, ulf.hansson, linux-mmc, linux-kernel, haibo.chen

On 3/03/21 7:42 pm, Frank Li wrote:
> [ 6684.493350] Unable to handle kernel paging request at virtual address ffff800011c5b0f0
> [ 6684.498531] mmc0: card 0001 removed
> [ 6684.501556] Mem abort info:
> [ 6684.509681]   ESR = 0x96000047
> [ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
> [ 6684.518394]   SET = 0, FnV = 0
> [ 6684.521707]   EA = 0, S1PTW = 0
> [ 6684.524998] Data abort info:
> [ 6684.528236]   ISV = 0, ISS = 0x00000047
> [ 6684.532986]   CM = 0, WnR = 1
> [ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081b22000
> [ 6684.543923] [ffff800011c5b0f0] pgd=00000000bffff003, p4d=00000000bffff003, pud=00000000bfffe003, pmd=00000000900e1003, pte=0000000000000000
> [ 6684.557915] Internal error: Oops: 96000047 [#1] PREEMPT SMP
> [ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core]
> [ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 5.10.9-01410-g3ba33182767b-dirty #10
> [ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
> [ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
> 
> [ 6684.606094] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
> [ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
> ^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci]
> [ 6684.626734] sp : ffff80001243b9f0
> [ 6684.630049] x29: ffff80001243b9f0 x28: ffff00002c3dd000
> [ 6684.635367] x27: 0000000000000001 x26: 0000000000000001
> [ 6684.640690] x25: ffff00002c451000 x24: 000000000000000f
> [ 6684.646007] x23: ffff000017e71c80 x22: ffff00002c451000
> [ 6684.651326] x21: ffff00002c0f3550 x20: ffff00002c0f3550
> [ 6684.656651] x19: ffff000017d46880 x18: ffff00002cea1500
> [ 6684.661977] x17: 0000000000000000 x16: 0000000000000000
> [ 6684.667294] x15: 000001ee628e3ed1 x14: 0000000000000278
> [ 6684.672610] x13: 0000000000000001 x12: 0000000000000001
> [ 6684.677927] x11: 0000000000000000 x10: 0000000000000000
> [ 6684.683243] x9 : 000000000000002b x8 : 0000000000001000
> [ 6684.688560] x7 : 0000000000000010 x6 : ffff00002c0f3678
> [ 6684.693886] x5 : 000000000000000f x4 : ffff800011c5b000
> [ 6684.699211] x3 : 000000000002d988 x2 : 0000000000000008
> [ 6684.704537] x1 : 00000000000000f0 x0 : 0002d9880008102f
> [ 6684.709854] Call trace:
> [ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
> [ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
> [ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
> [ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
> 
> cqhci_request was called after cqhci_disable.
> 
> cqhci_disable                                 cqhci_request
> {                                             {
> 	dmam_free_coherent();  (1) free
>                                                   if(!cq_host->enable)
>                                                        return
> 				         (2) pass check here
> 	cq_host->enable = false;
> 
>                                                   task_desc= get_desc(cq_host,tag);
>                                                              ^^^^ crash here
>                                          (3) access memory which is already free
> 
> }                                             }
> 
> Signed-off-by: Frank Li <Frank.Li@nxp.com>

Acked-by: Adrian Hunter <adrian.hunter@intel.com>

> ---
> 
> Change from v1 to v2
>  - use Adrian Hunter suggested method to fix this problem
> 
>  drivers/mmc/core/bus.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
> index c2e70b757dd1..4383c262b3f5 100644
> --- a/drivers/mmc/core/bus.c
> +++ b/drivers/mmc/core/bus.c
> @@ -399,11 +399,6 @@ void mmc_remove_card(struct mmc_card *card)
>  	mmc_remove_card_debugfs(card);
>  #endif
>  
> -	if (host->cqe_enabled) {
> -		host->cqe_ops->cqe_disable(host);
> -		host->cqe_enabled = false;
> -	}
> -
>  	if (mmc_card_present(card)) {
>  		if (mmc_host_is_spi(card->host)) {
>  			pr_info("%s: SPI card removed\n",
> @@ -416,6 +411,10 @@ void mmc_remove_card(struct mmc_card *card)
>  		of_node_put(card->dev.of_node);
>  	}
>  
> +	if (host->cqe_enabled) {
> +		host->cqe_ops->cqe_disable(host);
> +		host->cqe_enabled = false;
> +	}
> +
>  	put_device(&card->dev);
>  }
> -
> 


^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [PATCH v2 1/1] mmc: cqhci: fix random crash when remove mmc module
  2021-03-03 17:42 [PATCH v2 1/1] mmc: cqhci: fix random crash when remove mmc module Frank Li
  2021-03-03 17:49 ` Adrian Hunter
@ 2021-03-04 13:50 ` Ulf Hansson
  1 sibling, 0 replies; 3+ messages in thread
From: Ulf Hansson @ 2021-03-04 13:50 UTC (permalink / raw)
  To: Frank Li
  Cc: Adrian Hunter, Harjani Ritesh, Asutosh Das, linux-mmc,
	Linux Kernel Mailing List, Haibo Chen

On Wed, 3 Mar 2021 at 18:42, Frank Li <lznuaa@gmail.com> wrote:
>
> [ 6684.493350] Unable to handle kernel paging request at virtual address ffff800011c5b0f0
> [ 6684.498531] mmc0: card 0001 removed
> [ 6684.501556] Mem abort info:
> [ 6684.509681]   ESR = 0x96000047
> [ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
> [ 6684.518394]   SET = 0, FnV = 0
> [ 6684.521707]   EA = 0, S1PTW = 0
> [ 6684.524998] Data abort info:
> [ 6684.528236]   ISV = 0, ISS = 0x00000047
> [ 6684.532986]   CM = 0, WnR = 1
> [ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081b22000
> [ 6684.543923] [ffff800011c5b0f0] pgd=00000000bffff003, p4d=00000000bffff003, pud=00000000bfffe003, pmd=00000000900e1003, pte=0000000000000000
> [ 6684.557915] Internal error: Oops: 96000047 [#1] PREEMPT SMP
> [ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core]
> [ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 5.10.9-01410-g3ba33182767b-dirty #10
> [ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
> [ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
>
> [ 6684.606094] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
> [ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
> ^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci]
> [ 6684.626734] sp : ffff80001243b9f0
> [ 6684.630049] x29: ffff80001243b9f0 x28: ffff00002c3dd000
> [ 6684.635367] x27: 0000000000000001 x26: 0000000000000001
> [ 6684.640690] x25: ffff00002c451000 x24: 000000000000000f
> [ 6684.646007] x23: ffff000017e71c80 x22: ffff00002c451000
> [ 6684.651326] x21: ffff00002c0f3550 x20: ffff00002c0f3550
> [ 6684.656651] x19: ffff000017d46880 x18: ffff00002cea1500
> [ 6684.661977] x17: 0000000000000000 x16: 0000000000000000
> [ 6684.667294] x15: 000001ee628e3ed1 x14: 0000000000000278
> [ 6684.672610] x13: 0000000000000001 x12: 0000000000000001
> [ 6684.677927] x11: 0000000000000000 x10: 0000000000000000
> [ 6684.683243] x9 : 000000000000002b x8 : 0000000000001000
> [ 6684.688560] x7 : 0000000000000010 x6 : ffff00002c0f3678
> [ 6684.693886] x5 : 000000000000000f x4 : ffff800011c5b000
> [ 6684.699211] x3 : 000000000002d988 x2 : 0000000000000008
> [ 6684.704537] x1 : 00000000000000f0 x0 : 0002d9880008102f
> [ 6684.709854] Call trace:
> [ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
> [ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
> [ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
> [ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
>
> cqhci_request was called after cqhci_disable.
>
> cqhci_disable                                 cqhci_request
> {                                             {
>         dmam_free_coherent();  (1) free
>                                                   if(!cq_host->enable)
>                                                        return
>                                          (2) pass check here
>         cq_host->enable = false;
>
>                                                   task_desc= get_desc(cq_host,tag);
>                                                              ^^^^ crash here
>                                          (3) access memory which is already free
>
> }                                             }
>
> Signed-off-by: Frank Li <Frank.Li@nxp.com>

Applied for fixes, thanks! I added a fixes tag and a stable tag.

Kind regards
Uffe


> ---
>
> Change from v1 to v2
>  - use Adrian Hunter suggested method to fix this problem
>
>  drivers/mmc/core/bus.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
> index c2e70b757dd1..4383c262b3f5 100644
> --- a/drivers/mmc/core/bus.c
> +++ b/drivers/mmc/core/bus.c
> @@ -399,11 +399,6 @@ void mmc_remove_card(struct mmc_card *card)
>         mmc_remove_card_debugfs(card);
>  #endif
>
> -       if (host->cqe_enabled) {
> -               host->cqe_ops->cqe_disable(host);
> -               host->cqe_enabled = false;
> -       }
> -
>         if (mmc_card_present(card)) {
>                 if (mmc_host_is_spi(card->host)) {
>                         pr_info("%s: SPI card removed\n",
> @@ -416,6 +411,10 @@ void mmc_remove_card(struct mmc_card *card)
>                 of_node_put(card->dev.of_node);
>         }
>
> +       if (host->cqe_enabled) {
> +               host->cqe_ops->cqe_disable(host);
> +               host->cqe_enabled = false;
> +       }
> +
>         put_device(&card->dev);
>  }
> -
> --
> 2.25.1
>

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-03-04 13:52 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-03 17:42 [PATCH v2 1/1] mmc: cqhci: fix random crash when remove mmc module Frank Li
2021-03-03 17:49 ` Adrian Hunter
2021-03-04 13:50 ` Ulf Hansson

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.