From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Hans de Goede <hdegoede@redhat.com>
Cc: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>,
mazziesaccount@gmail.com, "Rafael J. Wysocki" <rafael@kernel.org>,
MyungJoo Ham <myungjoo.ham@samsung.com>,
Chanwoo Choi <cw00.choi@samsung.com>,
Andy Gross <agross@kernel.org>,
Bjorn Andersson <bjorn.andersson@linaro.org>,
Jean Delvare <jdelvare@suse.com>,
Guenter Roeck <linux@roeck-us.net>,
Mark Gross <mgross@linux.intel.com>,
Sebastian Reichel <sre@kernel.org>, Chen-Yu Tsai <wens@csie.org>,
Liam Girdwood <lgirdwood@gmail.com>,
Mark Brown <broonie@kernel.org>,
Wim Van Sebroeck <wim@linux-watchdog.org>,
Saravana Kannan <saravanak@google.com>,
Heikki Krogerus <heikki.krogerus@linux.intel.com>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
Joerg Roedel <jroedel@suse.de>,
Dan Williams <dan.j.williams@intel.com>,
Bartosz Golaszewski <bgolaszewski@baylibre.com>,
linux-kernel@vger.kernel.org, linux-arm-msm@vger.kernel.org,
linux-hwmon@vger.kernel.org, platform-driver-x86@vger.kernel.org,
linux-pm@vger.kernel.org, linux-watchdog@vger.kernel.org
Subject: Re: [RFC PATCH 1/7] drivers: base: Add resource managed version of delayed work init
Date: Sat, 13 Feb 2021 14:33:31 +0100 [thread overview]
Message-ID: <YCfVKyXbeJXNbMsd@kroah.com> (raw)
In-Reply-To: <284d4a13-5cc8-e23c-7e99-c03db5415bf1@redhat.com>
On Sat, Feb 13, 2021 at 02:18:06PM +0100, Hans de Goede wrote:
> Hi,
>
> On 2/13/21 1:16 PM, Greg Kroah-Hartman wrote:
> > On Sat, Feb 13, 2021 at 01:58:44PM +0200, Matti Vaittinen wrote:
> >> A few drivers which need a delayed work-queue must cancel work at exit.
> >> Some of those implement remove solely for this purpose. Help drivers
> >> to avoid unnecessary remove and error-branch implementation by adding
> >> managed verision of delayed work initialization
> >>
> >> Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
> >
> > That's not a good idea. As this would kick in when the device is
> > removed from the system, not when it is unbound from the driver, right?
>
> Erm, no devm managed resources get released when the driver is detached:
> drivers/base/dd.c: __device_release_driver() calls devres_release_all(dev);
Then why do you have to manually call devm_free_irq() in release
callbacks? I thought that was the primary problem with those things.
I can understand devm_ calls handling resources, but callbacks and
workqueues feels like a big stretch.
> > There is two different lifespans here (well 3). Code and data*2. Don't
> > confuse them as that will just cause lots of problems.
> >
> > The move toward more and more "devm" functions is not the way to go as
> > they just more and more make things easier to get wrong.
> >
> > APIs should be impossible to get wrong, this one is going to be almost
> > impossible to get right.
>
> I have to disagree here devm generally makes it easier to get things right,
> it is when some devm functions are missing and devm and non devm resources
> are mixed that things get tricky.
>
> Lets look for example at the drivers/extcon/extcon-intel-int3496.c code
> from patch 2/7 from this set. The removed driver-remove function looks like
> this:
>
> -static int int3496_remove(struct platform_device *pdev)
> -{
> - struct int3496_data *data = platform_get_drvdata(pdev);
> -
> - devm_free_irq(&pdev->dev, data->usb_id_irq, data);
> - cancel_delayed_work_sync(&data->work);
> -
> - return 0;
> -}
> -
>
> This is a good example where the mix of devm and non devm (the workqueue)
> resources makes things tricky. The IRQ must be freed first to avoid the
> work potentially getting re-queued after the sync cancel.
>
> In this case using devm for the IRQ may cause the driver author to forget
> about this, leaving a race.
>
> Bit with the new proposed devm_delayed_work_autocancel() function things
> will just work.
>
> This work gets queued by the IRQ handler, so the work must be initialized (1)
> *before* devm_request_irq() gets called. Any different order would be a
> bug in the probe function since then the IRQ might run before the work
> is initialized.
How are we now going to audit the order of these calls to ensure that
this is done correctly? That still feels like it is ripe for bugs in a
much easier way than without these functions.
> Since devm unrolls / releases resources in reverse order, this means that
> it will automatically free the IRQ (which was requested later) before
> cancelling the work.
>
> So by switching to the new devm_delayed_work_autocancel() function we avoid
> a case where a driver author can cause a race on driver detach because it is
> relying on devm to free the IRQ, which may cause it to requeue a just
> cancelled work.
>
> IOW introducing this function (and using it where appropriate) actually
> removes a possible class of bugs.
>
> patch 2/7 actually has a nice example of this, drivers/extcon/extcon-gpio.c
> also uses a delayed work queued by an interrupt, together with devm managing
> the interrupt, yet the removed driver_remove callback:
>
> -static int gpio_extcon_remove(struct platform_device *pdev)
> -{
> - struct gpio_extcon_data *data = platform_get_drvdata(pdev);
> -
> - cancel_delayed_work_sync(&data->work);
> -
> - return 0;
> -}
> -
>
> Is missing the explicit free on the IRQ which is necessary to avoid
> the race. One the one hand this illustrates your (Greg's) argument that
> devm managed IRQs may be a bad idea.
I still think it is :)
> OTOH it shows that if we have devm managed IRQs anyways that then also
> having devm managed autocancel works is a good idea, since this RFC patch-set
> not only results in some cleanup, but is actually fixing at least 1 driver
> detach race condition.
Fixing bugs is good, but the abstraction away from resource management
that the devm_ calls cause is worrying as the "magic" behind them can be
wrong, as seen here.
thanks,
greg k-h
next prev parent reply other threads:[~2021-02-13 13:34 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-13 11:58 [RFC PATCH 0/7] Add managed version of delayed work init Matti Vaittinen
2021-02-13 11:58 ` [RFC PATCH 1/7] drivers: base: Add resource " Matti Vaittinen
2021-02-13 12:16 ` Greg Kroah-Hartman
2021-02-13 12:26 ` Vaittinen, Matti
2021-02-13 12:38 ` gregkh
2021-02-13 13:18 ` Hans de Goede
2021-02-13 13:33 ` Greg Kroah-Hartman [this message]
2021-02-13 14:38 ` Hans de Goede
2021-02-13 14:52 ` Hans de Goede
2021-02-15 6:58 ` Matti Vaittinen
2021-02-13 15:03 ` Hans de Goede
2021-02-13 15:27 ` Guenter Roeck
2021-02-13 15:59 ` Hans de Goede
2021-02-13 18:17 ` Guenter Roeck
2021-02-15 7:22 ` Vaittinen, Matti
2021-02-15 10:37 ` Hans de Goede
2021-02-15 11:31 ` gregkh
2021-02-15 11:43 ` Hans de Goede
2021-02-15 13:12 ` Vaittinen, Matti
2021-02-13 12:18 ` [RFC PATCH 7/7] watchdog: retu_wdt: Clean-up by using managed " Matti Vaittinen
2021-02-18 16:28 ` [RFC PATCH 0/7] Add managed version of delayed " mark gross
2021-02-19 10:35 ` Matti Vaittinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YCfVKyXbeJXNbMsd@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=agross@kernel.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=bgolaszewski@baylibre.com \
--cc=bjorn.andersson@linaro.org \
--cc=broonie@kernel.org \
--cc=cw00.choi@samsung.com \
--cc=dan.j.williams@intel.com \
--cc=hdegoede@redhat.com \
--cc=heikki.krogerus@linux.intel.com \
--cc=jdelvare@suse.com \
--cc=jroedel@suse.de \
--cc=lgirdwood@gmail.com \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-hwmon@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=linux-watchdog@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=matti.vaittinen@fi.rohmeurope.com \
--cc=mazziesaccount@gmail.com \
--cc=mgross@linux.intel.com \
--cc=myungjoo.ham@samsung.com \
--cc=platform-driver-x86@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=saravanak@google.com \
--cc=sre@kernel.org \
--cc=wens@csie.org \
--cc=wim@linux-watchdog.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).