All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hans de Goede <hdegoede@redhat.com>
To: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: linux-usb <linux-usb@vger.kernel.org>
Subject: Re: AB BA lock inversion in ucsi driver caused by "usb: typec: ucsi: displayport: Fix a potential race during registration"
Date: Mon, 27 Jul 2020 14:54:00 +0200	[thread overview]
Message-ID: <95664b27-19c5-7cf8-2cd8-98ae956a6d31@redhat.com> (raw)
In-Reply-To: <20200727123735.GA883641@kuha.fi.intel.com>

Hi,

On 7/27/20 2:37 PM, Heikki Krogerus wrote:
> Hi Hans,
> 
> Sorry about the late reply. I just returned from vacation.

NP. I hope you've enjoyed your vacation.

> On Fri, Jul 17, 2020 at 12:04:58PM +0200, Hans de Goede wrote:
>> Hi Heikki,
>>
>> I've been running my personal kernel builds with lockdep enabled
>> (more people should do that) and it found an AB BA lock inversion in the
>> ucsi driver. This has been introduced by commit 081da1325d35 ("usb: typec:
>> ucsi: displayport: Fix a potential race during registration").
>>
>> The problem is as follows:
>>
>> AB order:
>>
>> 1. ucsi_init takes ucsi->ppm_lock (it runs with that locked for the duration of the function)
>> 2. usci_init eventually end up calling ucsi_register_displayport, which takes
>>     ucsi_connector->lock
>>
>> BA order:
>>
>> 1. ucsi_handle_connector_change work is started, takes ucsi_connector->lock
>> 2. ucsi_handle_connector_change calls ucsi_send_command which takes ucsi->ppm_lock
>>
>> I think this can be fixed by doing the following:
>>
>> a. Make ucsi_init drop the ucsi->ppm_lock before it starts registering ports; and
>>     replacing any ucsi_run_command calls after this point with ucsi_send_command
>>     (which is a wrapper around run_command taking the lock while handling the command)
>>
>> b. Move the taking of the ucsi_connector->lock from ucsi_register_displayport into
>>     ucsi_register_port() to make sure that nothing can touch the connector/port until
>>     ucsi_register_port() has completed.
>>
>>
>> b. is not stricly necessary but it brings the locking during init more inline
>> with locking done during runtime so this seems like a good idea.
> 
> Makes sense. So b. it is. Can you prepare the patch for that?

b. is just a cleanup / extra step on top of a. we need a. to fix the inversion.

If you are ok with that I can try to make some time for this...

Regards,

Hans


  reply	other threads:[~2020-07-27 12:54 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-17 10:04 AB BA lock inversion in ucsi driver caused by "usb: typec: ucsi: displayport: Fix a potential race during registration" Hans de Goede
2020-07-27 12:37 ` Heikki Krogerus
2020-07-27 12:54   ` Hans de Goede [this message]
2020-07-28 11:00     ` Heikki Krogerus

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=95664b27-19c5-7cf8-2cd8-98ae956a6d31@redhat.com \
    --to=hdegoede@redhat.com \
    --cc=heikki.krogerus@linux.intel.com \
    --cc=linux-usb@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.