From: Vladimir Oltean <olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org
Cc: linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
shawnguo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org,
robh+dt-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org,
mark.rutland-5wv7dgnIgG8@public.gmane.org,
devicetree-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
eha-/iRVSOupHO4@public.gmane.org,
angelo-BIYBQhTR83Y@public.gmane.org,
andrew.smirnov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org,
gustavo-L1vi/lXTdts+Va1GwOuvDg@public.gmane.org,
weic-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org,
mhosny-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org,
michael-QKn5cuLxLXY@public.gmane.org,
peng.ma-3arQi8VN3Tc@public.gmane.org
Subject: [PATCH v3 05/12] spi: spi-fsl-dspi: Protect against races on dspi->words_in_flight
Date: Sun, 15 Mar 2020 00:43:33 +0200 [thread overview]
Message-ID: <20200314224340.1544-6-olteanv@gmail.com> (raw)
In-Reply-To: <20200314224340.1544-1-olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
From: Vladimir Oltean <vladimir.oltean-3arQi8VN3Tc@public.gmane.org>
dspi->words_in_flight is a variable populated in the *_write functions
and used in the dspi_fifo_read function. It is also used in
dspi_fifo_write, immediately after transmission, to update the
message->actual_length variable used by higher layers such as spi-mem
for integrity checking.
But it may happen that the IRQ which calls dspi_fifo_read to be
triggered before the updating of message->actual_length takes place. In
that case, dspi_fifo_read will decrement dspi->words_in_flight to -1,
and that will cause an invalid modification of message->actual_length.
Make the simplest fix possible: don't decrement the actual shared
variable in dspi->words_in_flight from dspi_fifo_read, but actually a
copy of it which is on stack.
Suggested-by: Michael Walle <michael-QKn5cuLxLXY@public.gmane.org>
Signed-off-by: Vladimir Oltean <vladimir.oltean-3arQi8VN3Tc@public.gmane.org>
---
Changes in v4:
Patch is new.
drivers/spi/spi-fsl-dspi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 51224b772680..3ac004aa2abd 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -765,8 +765,10 @@ static u32 dspi_popr_read(struct fsl_dspi *dspi)
static void dspi_fifo_read(struct fsl_dspi *dspi)
{
+ int num_fifo_entries = dspi->words_in_flight;
+
/* Read one FIFO entry and push to rx buffer */
- while (dspi->words_in_flight--)
+ while (num_fifo_entries--)
dspi_push_rx(dspi, dspi_popr_read(dspi));
}
--
2.17.1
next prev parent reply other threads:[~2020-03-14 22:43 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-14 22:43 [PATCH v3 00/12] NXP DSPI bugfixes and support for LS1028A Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 01/12] spi: spi-fsl-dspi: Don't access reserved fields in SPI_MCR Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 06/12] spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion Vladimir Oltean
2020-03-16 12:26 ` Mark Brown
[not found] ` <20200316122613.GE5010-GFdadSzt00ze9xe1eoZjHA@public.gmane.org>
2020-03-16 12:29 ` Vladimir Oltean
[not found] ` <CA+h21hqRV+HmAz4QGyH9ZtcFWzeCKczitcn+mfTdwAC7ZobdDw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2020-03-16 12:49 ` Mark Brown
2020-03-16 13:00 ` Vladimir Oltean
[not found] ` <CA+h21hpoHGuDwpOqtWJFO7+0mQVUrmcBLW7nnGq6dt3QU5axfw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2020-03-16 13:25 ` Michael Walle
2020-03-16 16:23 ` Vladimir Oltean
[not found] ` <CA+h21hqt7Xe1LrSDsCVS8zqunQp2tKGhmHDraMirxL595go4nA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2020-03-16 17:15 ` Michael Walle
[not found] ` <8c22cb70b7c0acb6769e0c68540ab523-QKn5cuLxLXY@public.gmane.org>
2020-03-17 11:24 ` Michael Walle
2020-03-14 22:43 ` [PATCH v3 07/12] spi: spi-fsl-dspi: Avoid NULL pointer in dspi_slave_abort for non-DMA mode Vladimir Oltean
[not found] ` <20200314224340.1544-1-olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2020-03-14 22:43 ` [PATCH v3 02/12] spi: spi-fsl-dspi: Fix little endian access to PUSHR CMD and TXDATA Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 03/12] spi: spi-fsl-dspi: Fix bits-per-word acceleration in DMA mode Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 04/12] spi: spi-fsl-dspi: Avoid reading more data than written in EOQ mode Vladimir Oltean
2020-03-14 22:43 ` Vladimir Oltean [this message]
[not found] ` <20200314224340.1544-6-olteanv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2020-03-16 12:35 ` [PATCH v3 05/12] spi: spi-fsl-dspi: Protect against races on dspi->words_in_flight Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 08/12] spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 09/12] spi: spi-fsl-dspi: Move invariant configs out of dspi_transfer_one_message Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 10/12] spi: spi-fsl-dspi: Add support for LS1028A Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 11/12] arm64: dts: ls1028a: Specify the DMA channels for the DSPI controllers Vladimir Oltean
2020-03-14 22:43 ` [PATCH v3 12/12] arm64: dts: ls1028a-rdb: Add a spidev node for the mikroBUS Vladimir Oltean
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200314224340.1544-6-olteanv@gmail.com \
--to=olteanv-re5jqeeqqe8avxtiumwx3w@public.gmane.org \
--cc=andrew.smirnov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
--cc=angelo-BIYBQhTR83Y@public.gmane.org \
--cc=broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=devicetree-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=eha-/iRVSOupHO4@public.gmane.org \
--cc=gustavo-L1vi/lXTdts+Va1GwOuvDg@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=mark.rutland-5wv7dgnIgG8@public.gmane.org \
--cc=mhosny-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org \
--cc=michael-QKn5cuLxLXY@public.gmane.org \
--cc=peng.ma-3arQi8VN3Tc@public.gmane.org \
--cc=robh+dt-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=shawnguo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=weic-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).