From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
"Michał Mirosław" <mirq-linux@rere.qmqm.pl>,
"Jérôme Pouiller" <jerome.pouiller@silabs.com>
Subject: [PATCH 5.6 15/23] staging: wfx: fix init/remove vs IRQ race
Date: Tue, 31 Mar 2020 10:59:27 +0200 [thread overview]
Message-ID: <20200331085315.125120268@linuxfoundation.org> (raw)
In-Reply-To: <20200331085308.098696461@linuxfoundation.org>
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit 4033714d6cbe04893aa0708d1fcaa45dd8eb3f53 upstream.
Current code races in init/exit with interrupt handlers. This is noticed
by the warning below. Fix it by using devres for ordering allocations and
IRQ de/registration.
WARNING: CPU: 0 PID: 827 at drivers/staging/wfx/bus_spi.c:142 wfx_spi_irq_handler+0x5c/0x64 [wfx]
race condition in driver init/deinit
Cc: stable@vger.kernel.org
Fixes: 0096214a59a7 ("staging: wfx: add support for I/O access")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Reviewed-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/f0c66cbb3110c2736cd4357c753fba8c14ee3aee.1581416843.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/wfx/bus_sdio.c | 15 ++++++---------
drivers/staging/wfx/bus_spi.c | 27 ++++++++++++++-------------
drivers/staging/wfx/main.c | 21 +++++++++++++--------
drivers/staging/wfx/main.h | 1 -
4 files changed, 33 insertions(+), 31 deletions(-)
--- a/drivers/staging/wfx/bus_sdio.c
+++ b/drivers/staging/wfx/bus_sdio.c
@@ -200,25 +200,23 @@ static int wfx_sdio_probe(struct sdio_fu
if (ret)
goto err0;
- ret = wfx_sdio_irq_subscribe(bus);
- if (ret)
- goto err1;
-
bus->core = wfx_init_common(&func->dev, &wfx_sdio_pdata,
&wfx_sdio_hwbus_ops, bus);
if (!bus->core) {
ret = -EIO;
- goto err2;
+ goto err1;
}
+ ret = wfx_sdio_irq_subscribe(bus);
+ if (ret)
+ goto err1;
+
ret = wfx_probe(bus->core);
if (ret)
- goto err3;
+ goto err2;
return 0;
-err3:
- wfx_free_common(bus->core);
err2:
wfx_sdio_irq_unsubscribe(bus);
err1:
@@ -234,7 +232,6 @@ static void wfx_sdio_remove(struct sdio_
struct wfx_sdio_priv *bus = sdio_get_drvdata(func);
wfx_release(bus->core);
- wfx_free_common(bus->core);
wfx_sdio_irq_unsubscribe(bus);
sdio_claim_host(func);
sdio_disable_func(func);
--- a/drivers/staging/wfx/bus_spi.c
+++ b/drivers/staging/wfx/bus_spi.c
@@ -156,6 +156,11 @@ static void wfx_spi_request_rx(struct wo
wfx_bh_request_rx(bus->core);
}
+static void wfx_flush_irq_work(void *w)
+{
+ flush_work(w);
+}
+
static size_t wfx_spi_align_size(void *priv, size_t size)
{
// Most of SPI controllers avoid DMA if buffer size is not 32bit aligned
@@ -211,22 +216,23 @@ static int wfx_spi_probe(struct spi_devi
udelay(2000);
}
- ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler,
- IRQF_TRIGGER_RISING, "wfx", bus);
- if (ret)
- return ret;
-
INIT_WORK(&bus->request_rx, wfx_spi_request_rx);
bus->core = wfx_init_common(&func->dev, &wfx_spi_pdata,
&wfx_spi_hwbus_ops, bus);
if (!bus->core)
return -EIO;
- ret = wfx_probe(bus->core);
+ ret = devm_add_action_or_reset(&func->dev, wfx_flush_irq_work,
+ &bus->request_rx);
if (ret)
- wfx_free_common(bus->core);
+ return ret;
+
+ ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler,
+ IRQF_TRIGGER_RISING, "wfx", bus);
+ if (ret)
+ return ret;
- return ret;
+ return wfx_probe(bus->core);
}
static int wfx_spi_remove(struct spi_device *func)
@@ -234,11 +240,6 @@ static int wfx_spi_remove(struct spi_dev
struct wfx_spi_priv *bus = spi_get_drvdata(func);
wfx_release(bus->core);
- wfx_free_common(bus->core);
- // A few IRQ will be sent during device release. Hopefully, no IRQ
- // should happen after wdev/wvif are released.
- devm_free_irq(&func->dev, func->irq, bus);
- flush_work(&bus->request_rx);
return 0;
}
--- a/drivers/staging/wfx/main.c
+++ b/drivers/staging/wfx/main.c
@@ -262,6 +262,16 @@ static int wfx_send_pdata_pds(struct wfx
return ret;
}
+static void wfx_free_common(void *data)
+{
+ struct wfx_dev *wdev = data;
+
+ mutex_destroy(&wdev->rx_stats_lock);
+ mutex_destroy(&wdev->conf_mutex);
+ wfx_tx_queues_deinit(wdev);
+ ieee80211_free_hw(wdev->hw);
+}
+
struct wfx_dev *wfx_init_common(struct device *dev,
const struct wfx_platform_data *pdata,
const struct hwbus_ops *hwbus_ops,
@@ -332,15 +342,10 @@ struct wfx_dev *wfx_init_common(struct d
wfx_init_hif_cmd(&wdev->hif_cmd);
wfx_tx_queues_init(wdev);
- return wdev;
-}
+ if (devm_add_action_or_reset(dev, wfx_free_common, wdev))
+ return NULL;
-void wfx_free_common(struct wfx_dev *wdev)
-{
- mutex_destroy(&wdev->rx_stats_lock);
- mutex_destroy(&wdev->conf_mutex);
- wfx_tx_queues_deinit(wdev);
- ieee80211_free_hw(wdev->hw);
+ return wdev;
}
int wfx_probe(struct wfx_dev *wdev)
--- a/drivers/staging/wfx/main.h
+++ b/drivers/staging/wfx/main.h
@@ -34,7 +34,6 @@ struct wfx_dev *wfx_init_common(struct d
const struct wfx_platform_data *pdata,
const struct hwbus_ops *hwbus_ops,
void *hwbus_priv);
-void wfx_free_common(struct wfx_dev *wdev);
int wfx_probe(struct wfx_dev *wdev);
void wfx_release(struct wfx_dev *wdev);
next prev parent reply other threads:[~2020-03-31 9:01 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-31 8:59 [PATCH 5.6 00/23] 5.6.1-rc1 review Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 01/23] bpf: Undo incorrect __reg_bound_offset32 handling Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 02/23] USB: serial: option: add support for ASKEY WWHC050 Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 03/23] USB: serial: option: add BroadMobi BM806U Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 04/23] USB: serial: option: add Wistron Neweb D19Q1 Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 05/23] USB: cdc-acm: restore capability check order Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 06/23] USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 07/23] usb: musb: fix crash with highmen PIO and usbmon Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 08/23] media: flexcop-usb: fix endpoint sanity check Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 09/23] media: usbtv: fix control-message timeouts Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 10/23] staging: kpc2000: prevent underflow in cpld_reconfigure() Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 11/23] staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 12/23] staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 13/23] staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 14/23] staging: wfx: add proper "compatible" string Greg Kroah-Hartman
2020-03-31 8:59 ` Greg Kroah-Hartman [this message]
2020-03-31 8:59 ` [PATCH 5.6 16/23] staging: wfx: annotate nested gc_list vs tx queue locking Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 17/23] ahci: Add Intel Comet Lake H RAID PCI ID Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 18/23] libfs: fix infoleak in simple_attr_read() Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 19/23] media: ov519: add missing endpoint sanity checks Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 20/23] media: dib0700: fix rc endpoint lookup Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 21/23] media: stv06xx: add missing descriptor sanity checks Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 22/23] media: xirlink_cit: " Greg Kroah-Hartman
2020-03-31 8:59 ` [PATCH 5.6 23/23] media: v4l2-core: fix a use-after-free bug of sd->devnode Greg Kroah-Hartman
2020-03-31 18:07 ` [PATCH 5.6 00/23] 5.6.1-rc1 review Naresh Kamboju
2020-03-31 18:20 ` Linus Torvalds
2020-03-31 19:29 ` Arnaldo Carvalho de Melo
2020-03-31 23:18 ` Daniel Díaz
2020-04-01 12:40 ` Arnaldo Carvalho de Melo
2020-04-01 13:45 ` Daniel Díaz
2020-04-01 14:34 ` Arnaldo Carvalho de Melo
2020-04-01 15:07 ` Daniel Díaz
2020-04-04 8:41 ` [tip: perf/urgent] perf python: Fix clang detection to strip out options passed in $CC tip-bot2 for Arnaldo Carvalho de Melo
2020-03-31 19:32 ` [PATCH 5.6 00/23] 5.6.1-rc1 review shuah
2020-04-01 8:19 ` Greg Kroah-Hartman
2020-03-31 20:02 ` Vitor Massaru Iha
2020-04-01 2:25 ` Guenter Roeck
2020-04-01 8:20 ` Greg Kroah-Hartman
2020-04-01 3:06 ` Woody Suwalski
2020-04-01 5:51 ` Greg Kroah-Hartman
2020-04-01 5:53 ` Greg Kroah-Hartman
2020-04-01 11:06 ` Woody Suwalski
2020-04-01 11:18 ` Greg Kroah-Hartman
2020-04-01 15:40 ` shuah
2020-04-01 16:10 ` Greg Kroah-Hartman
2020-04-01 8:57 ` Jon Hunter
2020-04-01 9:33 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200331085315.125120268@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jerome.pouiller@silabs.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mirq-linux@rere.qmqm.pl \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).