From: Eugene Shatokhin <eugene.shatokhin@rosalab.ru>
To: Oliver Neukum <oneukum@suse.com>
Cc: netdev@vger.kernel.org, linux-usb@vger.kernel.org,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: Several races in "usbnet" module (kernel 4.1.x)
Date: Wed, 22 Jul 2015 21:33:52 +0300 [thread overview]
Message-ID: <55AFE210.7030104@rosalab.ru> (raw)
In-Reply-To: <1437488529.3823.16.camel@suse.com>
21.07.2015 17:22, Oliver Neukum пишет:
> On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote:
>> And here, the code clears EVENT_RX_KILL bit in dev->flags, which may
>> execute concurrently with the above operation:
>> #0 clear_bit (bitops.h:113, inlined)
>> #1 usbnet_bh (usbnet.c:1475)
>> /* restart RX again after disabling due to high error rate */
>> clear_bit(EVENT_RX_KILL, &dev->flags);
>>
>> If clear_bit() is atomic w.r.t. setting dev->flags to 0, this race is
>> not a problem, I guess. Otherwise, it may be.
>
> clear_bit is atomic with respect to other atomic operations.
> So how about this:
>
> Regards
> Oliver
>
Thanks for the quick replies!
My comments are below.
>>From 1c4e685b3a9c183e04c46b661830e5c7ed35b513 Mon Sep 17 00:00:00 2001
> From: Oliver Neukum <oneukum@suse.com>
> Date: Tue, 21 Jul 2015 16:19:40 +0200
> Subject: [PATCH] usbnet: fix race between usbnet_stop() and the BH
>
> Does this do the job?
>
> Signed-off-by: Oliver Neukum <oneukum@suse.com>
> ---
> drivers/net/usb/usbnet.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
> index 3c86b10..77a9a86 100644
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -778,7 +778,7 @@ int usbnet_stop (struct net_device *net)
> {
> struct usbnet *dev = netdev_priv(net);
> struct driver_info *info = dev->driver_info;
> - int retval, pm;
> + int retval, pm, mpn;
>
> clear_bit(EVENT_DEV_OPEN, &dev->flags);
> netif_stop_queue (net);
> @@ -813,14 +813,17 @@ int usbnet_stop (struct net_device *net)
> * can't flush_scheduled_work() until we drop rtnl (later),
> * else workers could deadlock; so make workers a NOP.
> */
> + mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags);
Right, I missed that. Indeed, if one needs EVENT_NO_RUNTIME_PM bit, one
should get it before dev->flags is set to 0.
> dev->flags = 0;
I suppose usbnet_bh() cannot be re-scheduled at this point. And if it is
running now, tasklet_kill will wait till it finishes. So, I guess, it
would be enough to zero dev->flags after "tasklet_kill (&dev->bh);"
rather than before it, like it is now.
Anyway, if it is needed to clear any particular flags to prevent
re-scheduling of usbnet_bh(), this can be done here with clear_bit().
Not sure if there are such flags, I am by no means an expert in usbnet.
> del_timer_sync (&dev->delay);
> tasklet_kill (&dev->bh);
The following part is not necessary, I think. usbnet_bh() does not touch
EVENT_NO_RUNTIME_PM bit explicitly and these bit operations are atomic
w.r.t. each other.
> + mpn |= !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags);
> + /* in case the bh reset a flag */
But zeroing dev->flags here is necessary, I agree.
> + dev->flags = 0;
> if (!pm)
> usb_autopm_put_interface(dev->intf);
>
> - if (info->manage_power &&
> - !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags))
> + if (info->manage_power && mpn)
> info->manage_power(dev, 0);
> else
> usb_autopm_put_interface(dev->intf);
>
Regards,
Eugene
next prev parent reply other threads:[~2015-07-22 18:33 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-20 18:13 Several races in "usbnet" module (kernel 4.1.x) Eugene Shatokhin
2015-07-21 12:04 ` Oliver Neukum
[not found] ` <1437480243.3823.5.camel-IBi9RG/b67k@public.gmane.org>
2015-07-24 17:38 ` Eugene Shatokhin
2015-07-27 12:29 ` Oliver Neukum
2015-07-27 13:53 ` Eugene Shatokhin
2015-07-21 13:07 ` Oliver Neukum
[not found] ` <55AD3A41.2040100-irhHPgl+04UvJsYlp49lxw@public.gmane.org>
2015-07-21 14:22 ` Oliver Neukum
2015-07-22 18:33 ` Eugene Shatokhin [this message]
2015-07-23 9:15 ` Oliver Neukum
2015-07-24 14:41 ` Eugene Shatokhin
2015-07-27 10:00 ` Oliver Neukum
2015-07-27 14:23 ` Eugene Shatokhin
2015-08-14 16:55 ` Eugene Shatokhin
2015-08-14 16:58 ` [PATCH] usbnet: Fix two races between usbnet_stop() and the BH Eugene Shatokhin
2015-08-19 1:54 ` David Miller
[not found] ` <20150818.185407.1667358232705414236.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2015-08-19 7:57 ` Eugene Shatokhin
2015-08-19 10:54 ` Bjørn Mork
2015-08-19 11:59 ` Eugene Shatokhin
2015-08-19 12:31 ` Bjørn Mork
2015-08-24 12:20 ` Eugene Shatokhin
2015-08-24 13:29 ` Bjørn Mork
2015-08-24 17:00 ` Eugene Shatokhin
2015-08-25 12:31 ` Oliver Neukum
2015-08-24 17:43 ` David Miller
[not found] ` <20150824.104328.554582952440857559.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2015-08-24 18:06 ` Alan Stern
2015-08-24 18:21 ` Alan Stern
2015-08-25 12:36 ` Oliver Neukum
2015-08-24 18:35 ` David Miller
2015-08-24 18:12 ` Eugene Shatokhin
2015-07-23 9:43 ` Several races in "usbnet" module (kernel 4.1.x) Oliver Neukum
2015-07-23 11:39 ` Eugene Shatokhin
2015-08-24 20:13 ` [PATCH 0/2] usbnet: Fix 2 problems in usbnet_stop() Eugene Shatokhin
2015-08-24 20:13 ` [PATCH 1/2] usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared Eugene Shatokhin
2015-08-25 13:01 ` Oliver Neukum
[not found] ` <1440507709.13824.6.camel-IBi9RG/b67k@public.gmane.org>
2015-08-25 14:16 ` Bjørn Mork
2015-08-25 14:22 ` Oliver Neukum
2015-08-26 2:44 ` David Miller
2015-08-24 20:13 ` [PATCH 2/2] usbnet: Fix a race between usbnet_stop() and the BH Eugene Shatokhin
2015-08-24 21:01 ` Bjørn Mork
2015-08-28 8:09 ` Eugene Shatokhin
2015-08-28 8:55 ` Bjørn Mork
2015-08-28 10:42 ` Eugene Shatokhin
2015-08-31 7:32 ` Bjørn Mork
2015-08-31 8:50 ` Eugene Shatokhin
2015-09-01 7:58 ` Oliver Neukum
2015-09-01 13:54 ` Eugene Shatokhin
2015-09-01 14:05 ` [PATCH] " Eugene Shatokhin
2015-09-08 7:24 ` Eugene Shatokhin
2015-09-08 7:37 ` Bjørn Mork
2015-09-08 7:48 ` Oliver Neukum
2015-09-08 20:18 ` David Miller
2015-09-01 7:57 ` [PATCH 2/2] " Oliver Neukum
2015-08-26 2:45 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55AFE210.7030104@rosalab.ru \
--to=eugene.shatokhin@rosalab.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=oneukum@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).