BUG? a suspected race bug at sdio_irq_thread()

BUG? a suspected race bug at sdio_irq_thread()

[홍신 shin hong]

Hello. I am reporting a suspected race bug at sdio_irq_thread()
in drivers/mmc/core/sdio_irq.c of Linux 2.6.30.5.

I hope this report is helpful. I am not certain whether this reports
real bug or not since I do not have much background.
So, please examine the report and let me know your opinion.

sdio_irq_therad() is spawned as a sdio_card_irq_get().
This thread is stopped by sdio_card_irq_put().

sdio_irq_thread() finishes its do-while iteration
when kthread_should_stop() returns true
or a condition is satisfied (break statements at line 106)

For the later case, if sdio_irq_thread() is finished
before kthread_should_stop() returns false.

In that situation, if other thread invokes kthread_stop(),
the caller of kthread_stop() might have a problem (waiting indefinitely).

Could you examine the possibility of this type of errors please?

Thank you

Sincerely
Shin Hong

Re: BUG? a suspected race bug at sdio_irq_thread()

[Nicolas Pitre]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1113 bytes --]

On Mon, 7 Sep 2009, 홍신 shin hong wrote:

> sdio_irq_therad() is spawned as a sdio_card_irq_get().
> This thread is stopped by sdio_card_irq_put().
> 
> sdio_irq_thread() finishes its do-while iteration
> when kthread_should_stop() returns true
> or a condition is satisfied (break statements at line 106)
> 
> For the later case, if sdio_irq_thread() is finished
> before kthread_should_stop() returns false.
> 
> In that situation, if other thread invokes kthread_stop(),
> the caller of kthread_stop() might have a problem (waiting indefinitely).

No.

First of all, you get one instance of sdio_irq_thread() for each card.  
And if a card has multiple functions, then multiple sdio_card_irq_get() 
and sdio_card_irq_put() are expected, and they should be balanced as 
well.

So, when the last user of SDIO card interrupt calls sdio_card_irq_put(), 
then kthread_stop() is called on the IRQ thread, meaning that the 
kthread_should_stop condition is made true and the thread awakened, and 
then its termination is waited for.  If the thread terminated itself 
then there is simply no waiting to do.


Nicolas