* [PATCH] dmaengine: idxd: fix missed completion on abort path
@ 2021-12-08 17:01 Dave Jiang
2021-12-13 5:40 ` Vinod Koul
0 siblings, 1 reply; 2+ messages in thread
From: Dave Jiang @ 2021-12-08 17:01 UTC (permalink / raw)
To: vkoul; +Cc: Ming Li, dmaengine
Ming reported that with the abort path of the descriptor submission, there
can be a window where a completed descriptor can be missed to be completed
by the irq completion thread:
CPU A CPU B
Submit (successful)
Submit (fail)
irq_process_work_list() // empty
llist_abort_desc()
// remove all descs from pending list
irq_process_pending_llist() // empty
exit idxd_wq_thread() with no processing
Add opportunistic descriptor completion in the abort path in order to
remove the missed completion.
Fixes: 6b4b87f2c31a ("dmaengine: idxd: fix submission race window")
Reported-by: Ming Li <ming4.li@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
drivers/dma/idxd/submit.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
index de76fb4abac2..83452fbbb168 100644
--- a/drivers/dma/idxd/submit.c
+++ b/drivers/dma/idxd/submit.c
@@ -106,6 +106,7 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
{
struct idxd_desc *d, *t, *found = NULL;
struct llist_node *head;
+ LIST_HEAD(flist);
desc->completion->status = IDXD_COMP_DESC_ABORT;
/*
@@ -120,7 +121,11 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
found = desc;
continue;
}
- list_add_tail(&desc->list, &ie->work_list);
+
+ if (d->completion->status)
+ list_add_tail(&d->list, &flist);
+ else
+ list_add_tail(&d->list, &ie->work_list);
}
}
@@ -130,6 +135,17 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
if (found)
complete_desc(found, IDXD_COMPLETE_ABORT);
+
+ /*
+ * complete_desc() will return desc to allocator and the desc can be
+ * acquired by a different process and the desc->list can be modified.
+ * Delete desc from list so the list trasversing does not get corrupted
+ * by the other process.
+ */
+ list_for_each_entry_safe(d, t, &flist, list) {
+ list_del_init(&d->list);
+ complete_desc(d, IDXD_COMPLETE_NORMAL);
+ }
}
int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] dmaengine: idxd: fix missed completion on abort path
2021-12-08 17:01 [PATCH] dmaengine: idxd: fix missed completion on abort path Dave Jiang
@ 2021-12-13 5:40 ` Vinod Koul
0 siblings, 0 replies; 2+ messages in thread
From: Vinod Koul @ 2021-12-13 5:40 UTC (permalink / raw)
To: Dave Jiang; +Cc: Ming Li, dmaengine
On 08-12-21, 10:01, Dave Jiang wrote:
> Ming reported that with the abort path of the descriptor submission, there
> can be a window where a completed descriptor can be missed to be completed
> by the irq completion thread:
>
> CPU A CPU B
> Submit (successful)
>
> Submit (fail)
> irq_process_work_list() // empty
>
> llist_abort_desc()
> // remove all descs from pending list
>
> irq_process_pending_llist() // empty
> exit idxd_wq_thread() with no processing
>
> Add opportunistic descriptor completion in the abort path in order to
> remove the missed completion.
Applied, thanks
--
~Vinod
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-12-13 5:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-08 17:01 [PATCH] dmaengine: idxd: fix missed completion on abort path Dave Jiang
2021-12-13 5:40 ` Vinod Koul
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.