* [PATCH] iio: buffer: Fix demux update
@ 2020-11-12 14:43 Nuno Sá
2020-11-12 17:28 ` Jonathan Cameron
0 siblings, 1 reply; 7+ messages in thread
From: Nuno Sá @ 2020-11-12 14:43 UTC (permalink / raw)
To: linux-iio; +Cc: Jonathan Cameron, Lars-Peter Clausen, Peter Meerwald-Stadler
When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.
Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
---
drivers/iio/industrialio-buffer.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index a4f6bb96d4f4..276b609d7917 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -865,12 +865,12 @@ static int iio_buffer_update_demux(struct iio_dev *indio_dev,
indio_dev->masklength,
in_ind + 1);
while (in_ind != out_ind) {
- in_ind = find_next_bit(indio_dev->active_scan_mask,
- indio_dev->masklength,
- in_ind + 1);
length = iio_storage_bytes_for_si(indio_dev, in_ind);
/* Make sure we are aligned */
in_loc = roundup(in_loc, length) + length;
+ in_ind = find_next_bit(indio_dev->active_scan_mask,
+ indio_dev->masklength,
+ in_ind + 1);
}
length = iio_storage_bytes_for_si(indio_dev, in_ind);
out_loc = roundup(out_loc, length);
--
2.29.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] iio: buffer: Fix demux update
2020-11-12 14:43 [PATCH] iio: buffer: Fix demux update Nuno Sá
@ 2020-11-12 17:28 ` Jonathan Cameron
2020-11-13 7:55 ` Sa, Nuno
0 siblings, 1 reply; 7+ messages in thread
From: Jonathan Cameron @ 2020-11-12 17:28 UTC (permalink / raw)
To: Nuno Sá
Cc: linux-iio, Jonathan Cameron, Lars-Peter Clausen, Peter Meerwald-Stadler
On Thu, 12 Nov 2020 15:43:22 +0100
Nuno Sá <nuno.sa@analog.com> wrote:
> When updating the buffer demux, we will skip a scan element from the
> device in the case `in_ind != out_ind` and we enter the while loop.
> in_ind should only be refreshed with `find_next_bit()` in the end of the
> loop.
>
> Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from device to buffer")
> Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Yikes that's been there a long time.
Could you provide an example of a particular layout and the result of this being wrong?
Thanks,
Jonathan
> ---
> drivers/iio/industrialio-buffer.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index a4f6bb96d4f4..276b609d7917 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -865,12 +865,12 @@ static int iio_buffer_update_demux(struct iio_dev *indio_dev,
> indio_dev->masklength,
> in_ind + 1);
> while (in_ind != out_ind) {
> - in_ind = find_next_bit(indio_dev->active_scan_mask,
> - indio_dev->masklength,
> - in_ind + 1);
> length = iio_storage_bytes_for_si(indio_dev, in_ind);
> /* Make sure we are aligned */
> in_loc = roundup(in_loc, length) + length;
> + in_ind = find_next_bit(indio_dev->active_scan_mask,
> + indio_dev->masklength,
> + in_ind + 1);
> }
> length = iio_storage_bytes_for_si(indio_dev, in_ind);
> out_loc = roundup(out_loc, length);
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH] iio: buffer: Fix demux update
2020-11-12 17:28 ` Jonathan Cameron
@ 2020-11-13 7:55 ` Sa, Nuno
2020-11-14 16:26 ` Jonathan Cameron
0 siblings, 1 reply; 7+ messages in thread
From: Sa, Nuno @ 2020-11-13 7:55 UTC (permalink / raw)
To: Jonathan Cameron
Cc: linux-iio, Jonathan Cameron, Lars-Peter Clausen, Peter Meerwald-Stadler
> -----Original Message-----
> From: Jonathan Cameron <Jonathan.Cameron@Huawei.com>
> Sent: Thursday, November 12, 2020 6:28 PM
> To: Sa, Nuno <Nuno.Sa@analog.com>
> Cc: linux-iio@vger.kernel.org; Jonathan Cameron <jic23@kernel.org>;
> Lars-Peter Clausen <lars@metafoo.de>; Peter Meerwald-Stadler
> <pmeerw@pmeerw.net>
> Subject: Re: [PATCH] iio: buffer: Fix demux update
>
>
> On Thu, 12 Nov 2020 15:43:22 +0100
> Nuno Sá <nuno.sa@analog.com> wrote:
>
> > When updating the buffer demux, we will skip a scan element from
> the
> > device in the case `in_ind != out_ind` and we enter the while loop.
> > in_ind should only be refreshed with `find_next_bit()` in the end of
> the
> > loop.
> >
> > Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from
> device to buffer")
> > Signed-off-by: Nuno Sá <nuno.sa@analog.com>
>
> Yikes that's been there a long time.
>
> Could you provide an example of a particular layout and the result of
> this being wrong?
>
Hi Jonathan,
Let's say:
iio_dev_mask: 0x0111
buffer_mask: 0x0100
We would get out_ind = 2 and in_ind = 0 and enter the loop. In the first
iteration we call find_next_bit() before doing the in_ind=0 computation which means we
will skip it and go directly to bit 1... And if we continue the path flow, we see that bit 2 will
be computed two times, so if we are lucky and scan_index0_len == scan_index2_len this
will go unnoticed...
Honestly, I didn't test this but it looks one of those things more or less clear by reading
the code or am I missing something here?
- Nuno Sá
> Thanks,
>
> Jonathan
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] iio: buffer: Fix demux update
2020-11-13 7:55 ` Sa, Nuno
@ 2020-11-14 16:26 ` Jonathan Cameron
2020-11-28 15:50 ` Jonathan Cameron
0 siblings, 1 reply; 7+ messages in thread
From: Jonathan Cameron @ 2020-11-14 16:26 UTC (permalink / raw)
To: Sa, Nuno
Cc: Jonathan Cameron, linux-iio, Lars-Peter Clausen, Peter Meerwald-Stadler
On Fri, 13 Nov 2020 07:55:21 +0000
"Sa, Nuno" <Nuno.Sa@analog.com> wrote:
> > -----Original Message-----
> > From: Jonathan Cameron <Jonathan.Cameron@Huawei.com>
> > Sent: Thursday, November 12, 2020 6:28 PM
> > To: Sa, Nuno <Nuno.Sa@analog.com>
> > Cc: linux-iio@vger.kernel.org; Jonathan Cameron <jic23@kernel.org>;
> > Lars-Peter Clausen <lars@metafoo.de>; Peter Meerwald-Stadler
> > <pmeerw@pmeerw.net>
> > Subject: Re: [PATCH] iio: buffer: Fix demux update
> >
> >
> > On Thu, 12 Nov 2020 15:43:22 +0100
> > Nuno Sá <nuno.sa@analog.com> wrote:
> >
> > > When updating the buffer demux, we will skip a scan element from
> > the
> > > device in the case `in_ind != out_ind` and we enter the while loop.
> > > in_ind should only be refreshed with `find_next_bit()` in the end of
> > the
> > > loop.
> > >
> > > Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from
> > device to buffer")
> > > Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> >
> > Yikes that's been there a long time.
> >
> > Could you provide an example of a particular layout and the result of
> > this being wrong?
> >
>
> Hi Jonathan,
>
> Let's say:
>
> iio_dev_mask: 0x0111
> buffer_mask: 0x0100
>
> We would get out_ind = 2 and in_ind = 0 and enter the loop. In the first
> iteration we call find_next_bit() before doing the in_ind=0 computation which means we
> will skip it and go directly to bit 1... And if we continue the path flow, we see that bit 2 will
> be computed two times, so if we are lucky and scan_index0_len == scan_index2_len this
> will go unnoticed...
>
> Honestly, I didn't test this but it looks one of those things more or less clear by reading
> the code or am I missing something here?
Mostly I was wondering why it hadn't bitten us before. I think you've identified
why with your "if we are lucky and scan_index0_len == scan_index2_len" then this will
go unnoticed.
It's very rare (though not unheard of) for a device to have it's main channels
of different widths (timestamp doesn't matter for this as it is always at the
end). The demux also only kicks in if we have a restricted channel
mask (or are using a kfifo and a buffer_cb which is rather rare). I suspect
we have few if any devices that actually run into this problem.
I guess I originally tested this code with devices I had at the time and none of
them would have tripped this.
Anyhow, whilst I agree with your analysis I'd like to leave this on list for
perhaps another week before applying it on the basis I'm paranoid and would
ideally like a few more eyes on this.
Good spot!
Jonathan
>
> - Nuno Sá
>
> > Thanks,
> >
> > Jonathan
> >
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] iio: buffer: Fix demux update
2020-11-14 16:26 ` Jonathan Cameron
@ 2020-11-28 15:50 ` Jonathan Cameron
0 siblings, 0 replies; 7+ messages in thread
From: Jonathan Cameron @ 2020-11-28 15:50 UTC (permalink / raw)
To: Sa, Nuno
Cc: Jonathan Cameron, linux-iio, Lars-Peter Clausen, Peter Meerwald-Stadler
On Sat, 14 Nov 2020 16:26:38 +0000
Jonathan Cameron <jic23@kernel.org> wrote:
> On Fri, 13 Nov 2020 07:55:21 +0000
> "Sa, Nuno" <Nuno.Sa@analog.com> wrote:
>
> > > -----Original Message-----
> > > From: Jonathan Cameron <Jonathan.Cameron@Huawei.com>
> > > Sent: Thursday, November 12, 2020 6:28 PM
> > > To: Sa, Nuno <Nuno.Sa@analog.com>
> > > Cc: linux-iio@vger.kernel.org; Jonathan Cameron <jic23@kernel.org>;
> > > Lars-Peter Clausen <lars@metafoo.de>; Peter Meerwald-Stadler
> > > <pmeerw@pmeerw.net>
> > > Subject: Re: [PATCH] iio: buffer: Fix demux update
> > >
> > >
> > > On Thu, 12 Nov 2020 15:43:22 +0100
> > > Nuno Sá <nuno.sa@analog.com> wrote:
> > >
> > > > When updating the buffer demux, we will skip a scan element from
> > > the
> > > > device in the case `in_ind != out_ind` and we enter the while loop.
> > > > in_ind should only be refreshed with `find_next_bit()` in the end of
> > > the
> > > > loop.
> > > >
> > > > Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from
> > > device to buffer")
> > > > Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> > >
> > > Yikes that's been there a long time.
> > >
> > > Could you provide an example of a particular layout and the result of
> > > this being wrong?
> > >
> >
> > Hi Jonathan,
> >
> > Let's say:
> >
> > iio_dev_mask: 0x0111
> > buffer_mask: 0x0100
> >
> > We would get out_ind = 2 and in_ind = 0 and enter the loop. In the first
> > iteration we call find_next_bit() before doing the in_ind=0 computation which means we
> > will skip it and go directly to bit 1... And if we continue the path flow, we see that bit 2 will
> > be computed two times, so if we are lucky and scan_index0_len == scan_index2_len this
> > will go unnoticed...
> >
> > Honestly, I didn't test this but it looks one of those things more or less clear by reading
> > the code or am I missing something here?
>
> Mostly I was wondering why it hadn't bitten us before. I think you've identified
> why with your "if we are lucky and scan_index0_len == scan_index2_len" then this will
> go unnoticed.
>
> It's very rare (though not unheard of) for a device to have it's main channels
> of different widths (timestamp doesn't matter for this as it is always at the
> end). The demux also only kicks in if we have a restricted channel
> mask (or are using a kfifo and a buffer_cb which is rather rare). I suspect
> we have few if any devices that actually run into this problem.
>
> I guess I originally tested this code with devices I had at the time and none of
> them would have tripped this.
>
> Anyhow, whilst I agree with your analysis I'd like to leave this on list for
> perhaps another week before applying it on the basis I'm paranoid and would
> ideally like a few more eyes on this.
>
Ah well. I'll take silence as meaning either everyone is happy or no
one else is going to read it ;)
Applied with a bit more text in the description to highlight that,
whilst a bug, it's actually not a common situation.
Given timing I've applied this to the togreg branch of iio.git
ready for the next merge window.
thanks,
Jonathan
> Good spot!
>
> Jonathan
>
> >
> > - Nuno Sá
> >
> > > Thanks,
> > >
> > > Jonathan
> > >
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH] iio: buffer: Fix demux update
@ 2023-10-04 21:50 Yeah Yeah
0 siblings, 0 replies; 7+ messages in thread
From: Yeah Yeah @ 2023-10-04 21:50 UTC (permalink / raw)
To: nuno.sa; +Cc: Jonathan.Cameron, jic23, lars, linux-iio, pmeerw
Sent from my iPhone
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH] iio: buffer: Fix demux update
@ 2023-10-03 1:18 Yeah Yeah
0 siblings, 0 replies; 7+ messages in thread
From: Yeah Yeah @ 2023-10-03 1:18 UTC (permalink / raw)
To: nuno.sa; +Cc: Jonathan.Cameron, jic23, lars, linux-iio, pmeerw
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2023-10-04 21:50 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-12 14:43 [PATCH] iio: buffer: Fix demux update Nuno Sá
2020-11-12 17:28 ` Jonathan Cameron
2020-11-13 7:55 ` Sa, Nuno
2020-11-14 16:26 ` Jonathan Cameron
2020-11-28 15:50 ` Jonathan Cameron
2023-10-03 1:18 Yeah Yeah
2023-10-04 21:50 Yeah Yeah
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.