From: Vladimir Oltean <olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org
Cc: linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
shawnguo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org,
robh+dt-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org,
mark.rutland-5wv7dgnIgG8@public.gmane.org,
devicetree-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
eha-/iRVSOupHO4@public.gmane.org,
angelo-BIYBQhTR83Y@public.gmane.org,
andrew.smirnov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org,
gustavo-L1vi/lXTdts+Va1GwOuvDg@public.gmane.org,
weic-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org,
mhosny-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org,
michael-QKn5cuLxLXY@public.gmane.org,
peng.ma-3arQi8VN3Tc@public.gmane.org
Subject: Re: [PATCH v3 05/12] spi: spi-fsl-dspi: Protect against races on dspi->words_in_flight
Date: Mon, 16 Mar 2020 12:35:04 +0000 (UTC) [thread overview]
Message-ID: <0ed0f4c8-5901-4d0f-b6e0-d641b3299e64@localhost> (raw)
In-Reply-To: <20200314224340.1544-6-olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Mar 15, 2020 12:44:02 AM Vladimir Oltean <olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>:
> From: Vladimir Oltean <vladimir.oltean-3arQi8VN3Tc@public.gmane.org>
>
> dspi->words_in_flight is a variable populated in the *_write functions
> and used in the dspi_fifo_read function. It is also used in
> dspi_fifo_write, immediately after transmission, to update the
> message->actual_length variable used by higher layers such as spi-mem
> for integrity checking.
>
> But it may happen that the IRQ which calls dspi_fifo_read to be
> triggered before the updating of message->actual_length takes place. In
> that case, dspi_fifo_read will decrement dspi->words_in_flight to -1,
> and that will cause an invalid modification of message->actual_length.
>
> Make the simplest fix possible: don't decrement the actual shared
> variable in dspi->words_in_flight from dspi_fifo_read, but actually a
> copy of it which is on stack.
>
> Suggested-by: Michael Walle <michael-QKn5cuLxLXY@public.gmane.org>
> Signed-off-by: Vladimir Oltean <vladimir.oltean-3arQi8VN3Tc@public.gmane.org>
> ---
> Changes in v4:
> Patch is new.
>
> drivers/spi/spi-fsl-dspi.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
> index 51224b772680..3ac004aa2abd 100644
> --- a/drivers/spi/spi-fsl-dspi.c
> +++ b/drivers/spi/spi-fsl-dspi.c
> @@ -765,8 +765,10 @@ static u32 dspi_popr_read(struct fsl_dspi *dspi)
>
> static void dspi_fifo_read(struct fsl_dspi *dspi)
> {
> + int num_fifo_entries = dspi->words_in_flight;
> +
> /* Read one FIFO entry and push to rx buffer */
> - while (dspi->words_in_flight--)
> + while (num_fifo_entries--)
> dspi_push_rx(dspi, dspi_popr_read(dspi));
> }
>
> --
> 2.17.1
>
>
Fixes: d59c90a2400f ("spi: spi-fsl-dspi: Convert TCFQ users to XSPI FIFO mode")
Patchwork should know to pick up this tag.
Thanks,
-Vladimir
next prev parent reply other threads:[~2020-03-16 12:35 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-14 22:43 [PATCH v3 00/12] NXP DSPI bugfixes and support for LS1028A Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 01/12] spi: spi-fsl-dspi: Don't access reserved fields in SPI_MCR Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 06/12] spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion Vladimir Oltean
2020-03-16 12:26 ` Mark Brown
[not found] ` <20200316122613.GE5010-GFdadSzt00ze9xe1eoZjHA@public.gmane.org>
2020-03-16 12:29 ` Vladimir Oltean
[not found] ` <CA+h21hqRV+HmAz4QGyH9ZtcFWzeCKczitcn+mfTdwAC7ZobdDw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2020-03-16 12:49 ` Mark Brown
2020-03-16 13:00 ` Vladimir Oltean
[not found] ` <CA+h21hpoHGuDwpOqtWJFO7+0mQVUrmcBLW7nnGq6dt3QU5axfw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2020-03-16 13:25 ` Michael Walle
2020-03-16 16:23 ` Vladimir Oltean
[not found] ` <CA+h21hqt7Xe1LrSDsCVS8zqunQp2tKGhmHDraMirxL595go4nA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2020-03-16 17:15 ` Michael Walle
[not found] ` <8c22cb70b7c0acb6769e0c68540ab523-QKn5cuLxLXY@public.gmane.org>
2020-03-17 11:24 ` Michael Walle
2020-03-14 22:43 ` [PATCH v3 07/12] spi: spi-fsl-dspi: Avoid NULL pointer in dspi_slave_abort for non-DMA mode Vladimir Oltean
[not found] ` <20200314224340.1544-1-olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2020-03-14 22:43 ` [PATCH v3 02/12] spi: spi-fsl-dspi: Fix little endian access to PUSHR CMD and TXDATA Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 03/12] spi: spi-fsl-dspi: Fix bits-per-word acceleration in DMA mode Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 04/12] spi: spi-fsl-dspi: Avoid reading more data than written in EOQ mode Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 05/12] spi: spi-fsl-dspi: Protect against races on dspi->words_in_flight Vladimir Oltean
[not found] ` <20200314224340.1544-6-olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2020-03-16 12:35 ` Vladimir Oltean [this message]
2020-03-14 22:43 ` [PATCH v3 08/12] spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 09/12] spi: spi-fsl-dspi: Move invariant configs out of dspi_transfer_one_message Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 10/12] spi: spi-fsl-dspi: Add support for LS1028A Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 11/12] arm64: dts: ls1028a: Specify the DMA channels for the DSPI controllers Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 12/12] arm64: dts: ls1028a-rdb: Add a spidev node for the mikroBUS Vladimir Oltean
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0ed0f4c8-5901-4d0f-b6e0-d641b3299e64@localhost \
--to=olteanv-re5jqeeqqe8avxtiumwx3w@public.gmane.org \
--cc=andrew.smirnov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
--cc=angelo-BIYBQhTR83Y@public.gmane.org \
--cc=broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=devicetree-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=eha-/iRVSOupHO4@public.gmane.org \
--cc=gustavo-L1vi/lXTdts+Va1GwOuvDg@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=mark.rutland-5wv7dgnIgG8@public.gmane.org \
--cc=mhosny-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org \
--cc=michael-QKn5cuLxLXY@public.gmane.org \
--cc=peng.ma-3arQi8VN3Tc@public.gmane.org \
--cc=robh+dt-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=shawnguo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=weic-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).