archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <>
Cc: Logan Gunthorpe <>,
	Sebastian Andrzej Siewior <>,
	Thomas Gleixner <>,
	Peter Zijlstra <>,
	Bjorn Helgaas <>,
	Sasha Levin <>,
Subject: [PATCH AUTOSEL 5.4 21/46] PCI/switchtec: Fix init_completion race condition with poll_wait()
Date: Thu,  9 Apr 2020 23:48:44 -0400	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Logan Gunthorpe <>

[ Upstream commit efbdc769601f4d50018bf7ca50fc9f7c67392ece ]

The call to init_completion() in mrpc_queue_cmd() can theoretically
race with the call to poll_wait() in switchtec_dev_poll().

  poll()			write()
    switchtec_dev_poll()   	  switchtec_dev_write()
      poll_wait(&s->comp.wait);      mrpc_queue_cmd()

To my knowledge, no one has hit this bug.

Fix this by using reinit_completion() instead of init_completion() in

Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")

Reported-by: Sebastian Andrzej Siewior <>
Signed-off-by: Logan Gunthorpe <>
Signed-off-by: Thomas Gleixner <>
Signed-off-by: Peter Zijlstra (Intel) <>
Acked-by: Bjorn Helgaas <>
Signed-off-by: Sasha Levin <>
 drivers/pci/switch/switchtec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index cc43c855452f7..2c9c3061894b2 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -175,7 +175,7 @@ static int mrpc_queue_cmd(struct switchtec_user *stuser)
 	stuser->read_len = sizeof(stuser->data);
 	stuser_set_state(stuser, MRPC_QUEUED);
-	init_completion(&stuser->comp);
+	reinit_completion(&stuser->comp);
 	list_add_tail(&stuser->list, &stdev->mrpc_queue);

           reply	other threads:[~2020-04-10  3:56 UTC|newest]

Thread overview: expand[flat|nested]  mbox.gz  Atom feed
 [parent not found: <>]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).