From: Oliver Neukum <oneukum@suse.com>
To: "Ye, Xiang" <xiang.ye@intel.com>, Oliver Neukum <oneukum@suse.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Arnd Bergmann <arnd@arndb.de>,
Matthias Kaehlcke <mka@chromium.org>, Lee Jones <lee@kernel.org>,
Wolfram Sang <wsa@kernel.org>, Tyrone Ting <kfting@nuvoton.com>,
Mark Brown <broonie@kernel.org>,
Linus Walleij <linus.walleij@linaro.org>,
Bartosz Golaszewski <brgl@bgdev.pl>,
linux-usb@vger.kernel.org, linux-i2c@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-spi@vger.kernel.org,
linux-gpio@vger.kernel.org, srinivas.pandruvada@intel.com,
heikki.krogerus@linux.intel.com,
andriy.shevchenko@linux.intel.com, sakari.ailus@linux.intel.com,
zhifeng.wang@intel.com, wentong.wu@intel.com,
lixu.zhang@intel.com
Subject: Re: [PATCH v4 1/5] mfd: Add support for Intel LJCA device
Date: Mon, 13 Mar 2023 14:27:50 +0100 [thread overview]
Message-ID: <ca995ed7-e6db-4265-e528-5e29fb418594@suse.com> (raw)
In-Reply-To: <ZAqukC7XfSbIa9ov@ye-NUC7i7DNHE>
On 10.03.23 05:14, Ye, Xiang wrote:
> Hi Oliver,
Hi,
sorry for the delayed answer.
> Thanks for your review.
> On Thu, Mar 09, 2023 at 01:53:28PM +0100, Oliver Neukum wrote:
>>
>>
>> On 09.03.23 08:10, Ye Xiang wrote:
>>
>>> +static int ljca_stub_write(struct ljca_stub *stub, u8 cmd, const void *obuf, unsigned int obuf_len,
>>> + void *ibuf, unsigned int *ibuf_len, bool wait_ack, unsigned long timeout)
>>
>> Why do you make ibuf_len a pointer?
> Because ibuf_len is also used as output of this function here.
> It stores the actual length of ibuf receive from LJCA device.
Yes, I understand that now, thank you for the explanation, yet
that is problematic, if we look at another issue. See further down:
>>> + ret = -ENODEV;
>>> + goto error_put;
>>> + }
>>> +
>>> + mutex_lock(&dev->mutex);
>>> + stub->cur_cmd = cmd;
>>> + stub->ipacket.ibuf = ibuf;
>>> + stub->ipacket.ibuf_len = ibuf_len;
Here you store the pointer into the stub. Hence we must make sure
that the location it points to stays valid.
>>> + stub->acked = false;
>>> + ret = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, dev->out_ep), header, msg_len,
>>> + &actual, LJCA_USB_WRITE_TIMEOUT_MS);
>>> + kfree(header);
>>> + if (ret) {
>>> + dev_err(&dev->intf->dev, "bridge write failed ret:%d\n", ret);
>>> + goto error_unlock;
>>> + }
>>> +
>>> + if (actual != msg_len) {
>>> + dev_err(&dev->intf->dev, "bridge write length mismatch (%d vs %d)\n", msg_len,
>>> + actual);
>>> + ret = -EINVAL;
>>> + goto error_unlock;
>>> + }
>>> +
>>> + if (wait_ack) {
>>> + ret = wait_event_timeout(dev->ack_wq, stub->acked, msecs_to_jiffies(timeout));
>>> + if (!ret) {
>>> + dev_err(&dev->intf->dev, "acked wait timeout\n");
>>> + ret = -ETIMEDOUT;
The function will return an error in the timeout case.
This may be a trivial observation but it becomes important.
>> If that triggers, you may have a pending URB.
I misspoke. Pending IO would have been correct.
>> You must kill it.
> which URB? I guess what you mean is dev->in_urb?
> But the in_urb should always be up to waiting for message from firmware,
> even through this timeout happen.
Now let's look at ljca_mng_reset_handshake(). I am afraid I have to quote
its first part in full:
+static int ljca_mng_reset_handshake(struct ljca_stub *stub)
+{
+ struct ljca_mng_priv *priv;
+ __le32 reset_id;
+ __le32 reset_id_ret = 0;
+ unsigned int ilen = sizeof(__le32);
This is on the _stack_
Highly important !!!
+ int ret;
+
+ priv = ljca_priv(stub);
+ reset_id = cpu_to_le32(priv->reset_id++);
+ ret = ljca_stub_write(stub, LJCA_MNG_RESET_NOTIFY, &reset_id, sizeof(reset_id),
+ &reset_id_ret, &ilen, true, LJCA_USB_WRITE_ACK_TIMEOUT_MS);
If we run into the timeout error case, ret will be -ETIMEDOUT.
+ if (ret)
+ return ret;
And thus here we return and free the stack _including_ "ilen", which we
still have a pointer to. That means if the operation concludes after
a timeout, we _will_ follow a rogue pointer.
A couple of functions have this race condition.
>> What happens to stub in the error case?
> ljca_add_mfd_cell only failed when krealloc_array failing. When
> ljca_add_mfd_cell fails, the related stub just be left alone here.
>
> Maybe I should free the stub here when fails? what is your advice?
Yes, that is the cleanest solution.
>>> + }
>>> +
>>> + return 0;
>>> +}
>>
>>
>>> +
>>> +static void ljca_disconnect(struct usb_interface *intf)
>>> +{
>>> + struct ljca_dev *dev = usb_get_intfdata(intf);
>>> +
>>> + ljca_stop(dev);
>>
>> What prevents restarting the device here?
Sorry, you are calling ljca_start() only in probe(9 and resume()
Your code is correct.
Regards
Oliver
next prev parent reply other threads:[~2023-03-13 13:28 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-09 7:10 [PATCH v4 0/5] Add Intel LJCA device driver Ye Xiang
2023-03-09 7:10 ` [PATCH v4 1/5] mfd: Add support for Intel LJCA device Ye Xiang
2023-03-09 7:49 ` Greg Kroah-Hartman
2023-03-09 9:10 ` Ye, Xiang
2023-03-09 9:26 ` Greg Kroah-Hartman
2023-03-09 10:16 ` Ye, Xiang
2023-03-09 7:52 ` Greg Kroah-Hartman
2023-03-09 9:31 ` Ye, Xiang
2023-03-09 9:41 ` Greg Kroah-Hartman
2023-03-09 10:06 ` Andi Shyti
2023-03-09 15:45 ` Ye, Xiang
2023-03-09 15:58 ` Greg Kroah-Hartman
2023-03-09 17:42 ` Ye, Xiang
2023-03-09 7:56 ` Arnd Bergmann
2023-03-09 10:00 ` Ye, Xiang
2023-03-09 11:03 ` Mark Brown
2023-03-09 11:30 ` Arnd Bergmann
2023-03-09 12:53 ` Oliver Neukum
2023-03-10 4:14 ` Ye, Xiang
2023-03-13 13:27 ` Oliver Neukum [this message]
2023-03-14 7:15 ` Ye, Xiang
2023-03-09 7:10 ` [PATCH v4 2/5] gpio: Add support for Intel LJCA USB GPIO driver Ye Xiang
2023-03-09 13:40 ` Oliver Neukum
2023-03-09 13:52 ` Andy Shevchenko
2023-03-09 14:06 ` Greg Kroah-Hartman
2023-03-09 14:18 ` Linus Walleij
2023-03-09 14:36 ` Greg Kroah-Hartman
2023-03-09 14:48 ` Arnd Bergmann
2023-03-09 17:37 ` Oliver Neukum
2023-03-09 17:30 ` Oliver Neukum
2023-03-10 5:01 ` Ye, Xiang
2023-03-10 7:11 ` Greg Kroah-Hartman
2023-03-10 7:39 ` Ye, Xiang
2023-03-10 7:53 ` Greg Kroah-Hartman
2023-03-10 8:59 ` Ye, Xiang
2023-03-11 12:13 ` Krzysztof Kozlowski
2023-03-12 15:40 ` Ye, Xiang
2023-03-09 7:10 ` [PATCH v4 3/5] i2c: Add support for Intel LJCA USB I2C driver Ye Xiang
2023-03-09 7:10 ` [PATCH v4 4/5] spi: Add support for Intel LJCA USB SPI driver Ye Xiang
2023-03-09 7:11 ` [PATCH v4 5/5] Documentation: Add ABI doc for attributes of LJCA device Ye Xiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ca995ed7-e6db-4265-e528-5e29fb418594@suse.com \
--to=oneukum@suse.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=arnd@arndb.de \
--cc=brgl@bgdev.pl \
--cc=broonie@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=kfting@nuvoton.com \
--cc=lee@kernel.org \
--cc=linus.walleij@linaro.org \
--cc=linux-gpio@vger.kernel.org \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=lixu.zhang@intel.com \
--cc=mka@chromium.org \
--cc=sakari.ailus@linux.intel.com \
--cc=srinivas.pandruvada@intel.com \
--cc=wentong.wu@intel.com \
--cc=wsa@kernel.org \
--cc=xiang.ye@intel.com \
--cc=zhifeng.wang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).