| Message ID | 1699341365-47737-4-git-send-email-quic_qianyu@quicinc.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | bus: mhi: host: Add lock to avoid race when ringing channel DB | expand |
Hi Qiang,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Qiang-Yu/bus-mhi-host-Add-spinlock-to-protect-WP-access-when-queueing-TREs/20231107-151918
base: https://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi.git mhi-next
patch link: https://lore.kernel.org/r/1699341365-47737-4-git-send-email-quic_qianyu%40quicinc.com
patch subject: [PATCH v3 3/4] bus: mhi: host: Avoid processing buffer and event of a disable channel
config: x86_64-randconfig-161-20231107 (https://download.01.org/0day-ci/archive/20231108/202311080155.MiyREgoQ-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce: (https://download.01.org/0day-ci/archive/20231108/202311080155.MiyREgoQ-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202311080155.MiyREgoQ-lkp@intel.com/
smatch warnings:
drivers/bus/mhi/host/main.c:1257 mhi_gen_tre() warn: inconsistent returns '&mhi_chan->lock'.
vim +1257 drivers/bus/mhi/host/main.c
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1204 int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan,
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1205 struct mhi_buf_info *info, enum mhi_flags flags)
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1206 {
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1207 struct mhi_ring *buf_ring, *tre_ring;
84f5f31f110e5e drivers/bus/mhi/host/main.c Manivannan Sadhasivam 2022-03-01 1208 struct mhi_ring_element *mhi_tre;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1209 struct mhi_buf_info *buf_info;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1210 int eot, eob, chain, bei;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1211 int ret;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1212
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1213 /* Protect accesses for reading and incrementing WP */
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1214 write_lock_bh(&mhi_chan->lock);
6025cde6ecb13c drivers/bus/mhi/host/main.c Qiang Yu 2023-11-07 1215 if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED)
6025cde6ecb13c drivers/bus/mhi/host/main.c Qiang Yu 2023-11-07 1216 return -EINVAL;
This looks like two people submitted patches on the same day?
We should unlock before returning?
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1217
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1218 buf_ring = &mhi_chan->buf_ring;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1219 tre_ring = &mhi_chan->tre_ring;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1220
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1221 buf_info = buf_ring->wp;
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1222 WARN_ON(buf_info->used);
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1223 buf_info->pre_mapped = info->pre_mapped;
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1224 if (info->pre_mapped)
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1225 buf_info->p_addr = info->p_addr;
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1226 else
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1227 buf_info->v_addr = info->v_addr;
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1228 buf_info->cb_buf = info->cb_buf;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1229 buf_info->wp = tre_ring->wp;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1230 buf_info->dir = mhi_chan->dir;
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1231 buf_info->len = info->len;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1232
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1233 if (!info->pre_mapped) {
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1234 ret = mhi_cntrl->map_single(mhi_cntrl, buf_info);
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1235 if (ret) {
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1236 write_unlock_bh(&mhi_chan->lock);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1237 return ret;
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1238 }
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1239 }
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1240
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1241 eob = !!(flags & MHI_EOB);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1242 eot = !!(flags & MHI_EOT);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1243 chain = !!(flags & MHI_CHAIN);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1244 bei = !!(mhi_chan->intmod);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1245
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1246 mhi_tre = tre_ring->wp;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1247 mhi_tre->ptr = MHI_TRE_DATA_PTR(buf_info->p_addr);
cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1248 mhi_tre->dword[0] = MHI_TRE_DATA_DWORD0(info->len);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1249 mhi_tre->dword[1] = MHI_TRE_DATA_DWORD1(bei, eot, eob, chain);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1250
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1251 /* increment WP */
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1252 mhi_add_ring_element(mhi_cntrl, tre_ring);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1253 mhi_add_ring_element(mhi_cntrl, buf_ring);
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1254
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1255 write_unlock_bh(&mhi_chan->lock);
da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1256
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 @1257 return 0;
189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1258 }
On Tue, Nov 07, 2023 at 03:16:04PM +0800, Qiang Yu wrote: > Ckeck mhi channel state after getting chan->lock to ensure that we only > queue buffer to an enabled channel and process event of an enabled channel. > This commit message doesn't give proper explanation on how the channel can go to disabled state in between parse_xfer_event() and mhi_gen_tre(). - Mani > Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> > --- > drivers/bus/mhi/host/main.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c > index a236dc2..b137d54 100644 > --- a/drivers/bus/mhi/host/main.c > +++ b/drivers/bus/mhi/host/main.c > @@ -672,6 +672,8 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl, > } > > read_lock_bh(&mhi_chan->lock); > + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) > + goto end_process_tx_event; > } > break; > } /* CC_EOT */ > @@ -1211,6 +1213,8 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, > > /* Protect accesses for reading and incrementing WP */ > write_lock_bh(&mhi_chan->lock); > + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) > + return -EINVAL; > > buf_ring = &mhi_chan->buf_ring; > tre_ring = &mhi_chan->tre_ring; > -- > 2.7.4 > >
On 11/10/2023 12:32 AM, Manivannan Sadhasivam wrote: > On Tue, Nov 07, 2023 at 03:16:04PM +0800, Qiang Yu wrote: >> Ckeck mhi channel state after getting chan->lock to ensure that we only >> queue buffer to an enabled channel and process event of an enabled channel. >> > This commit message doesn't give proper explanation on how the channel can go to > disabled state in between parse_xfer_event() and mhi_gen_tre(). > > - Mani Hi Mani. How about following commit message MHI channel state is protected by mhi_chan->lock. Hence, after core drops mhi_chan->lock during processing xfer event, it can not prevent channel state being changed if client closes channel or driver is removed at this time. So let's check mhi channel state after getting chan->lock again to avoid queuing buffer to a disabled channel in xfer callback and stop processing event of the disabled channel. >> Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> >> --- >> drivers/bus/mhi/host/main.c | 4 ++++ >> 1 file changed, 4 insertions(+) >> >> diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c >> index a236dc2..b137d54 100644 >> --- a/drivers/bus/mhi/host/main.c >> +++ b/drivers/bus/mhi/host/main.c >> @@ -672,6 +672,8 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl, >> } >> >> read_lock_bh(&mhi_chan->lock); >> + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) >> + goto end_process_tx_event; >> } >> break; >> } /* CC_EOT */ >> @@ -1211,6 +1213,8 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, >> >> /* Protect accesses for reading and incrementing WP */ >> write_lock_bh(&mhi_chan->lock); >> + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) >> + return -EINVAL; >> >> buf_ring = &mhi_chan->buf_ring; >> tre_ring = &mhi_chan->tre_ring; >> -- >> 2.7.4 >> >>
On 11/8/2023 2:48 PM, Dan Carpenter wrote: > Hi Qiang, > > kernel test robot noticed the following build warnings: > > https://git-scm.com/docs/git-format-patch#_base_tree_information] > > url: https://github.com/intel-lab-lkp/linux/commits/Qiang-Yu/bus-mhi-host-Add-spinlock-to-protect-WP-access-when-queueing-TREs/20231107-151918 > base: https://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi.git mhi-next > patch link: https://lore.kernel.org/r/1699341365-47737-4-git-send-email-quic_qianyu%40quicinc.com > patch subject: [PATCH v3 3/4] bus: mhi: host: Avoid processing buffer and event of a disable channel > config: x86_64-randconfig-161-20231107 (https://download.01.org/0day-ci/archive/20231108/202311080155.MiyREgoQ-lkp@intel.com/config) > compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 > reproduce: (https://download.01.org/0day-ci/archive/20231108/202311080155.MiyREgoQ-lkp@intel.com/reproduce) > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > the same patch/commit), kindly add following tags > | Reported-by: kernel test robot <lkp@intel.com> > | Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > | Closes: https://lore.kernel.org/r/202311080155.MiyREgoQ-lkp@intel.com/ > > smatch warnings: > drivers/bus/mhi/host/main.c:1257 mhi_gen_tre() warn: inconsistent returns '&mhi_chan->lock'. > > vim +1257 drivers/bus/mhi/host/main.c > > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1204 int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1205 struct mhi_buf_info *info, enum mhi_flags flags) > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1206 { > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1207 struct mhi_ring *buf_ring, *tre_ring; > 84f5f31f110e5e drivers/bus/mhi/host/main.c Manivannan Sadhasivam 2022-03-01 1208 struct mhi_ring_element *mhi_tre; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1209 struct mhi_buf_info *buf_info; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1210 int eot, eob, chain, bei; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1211 int ret; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1212 > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1213 /* Protect accesses for reading and incrementing WP */ > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1214 write_lock_bh(&mhi_chan->lock); > 6025cde6ecb13c drivers/bus/mhi/host/main.c Qiang Yu 2023-11-07 1215 if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) > 6025cde6ecb13c drivers/bus/mhi/host/main.c Qiang Yu 2023-11-07 1216 return -EINVAL; > > This looks like two people submitted patches on the same day? > We should unlock before returning? Yes, we should unlock before return, will change in next version patch. Thank you. > > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1217 > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1218 buf_ring = &mhi_chan->buf_ring; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1219 tre_ring = &mhi_chan->tre_ring; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1220 > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1221 buf_info = buf_ring->wp; > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1222 WARN_ON(buf_info->used); > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1223 buf_info->pre_mapped = info->pre_mapped; > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1224 if (info->pre_mapped) > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1225 buf_info->p_addr = info->p_addr; > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1226 else > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1227 buf_info->v_addr = info->v_addr; > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1228 buf_info->cb_buf = info->cb_buf; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1229 buf_info->wp = tre_ring->wp; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1230 buf_info->dir = mhi_chan->dir; > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1231 buf_info->len = info->len; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1232 > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1233 if (!info->pre_mapped) { > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1234 ret = mhi_cntrl->map_single(mhi_cntrl, buf_info); > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1235 if (ret) { > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1236 write_unlock_bh(&mhi_chan->lock); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1237 return ret; > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1238 } > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1239 } > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1240 > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1241 eob = !!(flags & MHI_EOB); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1242 eot = !!(flags & MHI_EOT); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1243 chain = !!(flags & MHI_CHAIN); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1244 bei = !!(mhi_chan->intmod); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1245 > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1246 mhi_tre = tre_ring->wp; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1247 mhi_tre->ptr = MHI_TRE_DATA_PTR(buf_info->p_addr); > cd116318803f5e drivers/bus/mhi/core/main.c Hemant Kumar 2020-05-21 1248 mhi_tre->dword[0] = MHI_TRE_DATA_DWORD0(info->len); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1249 mhi_tre->dword[1] = MHI_TRE_DATA_DWORD1(bei, eot, eob, chain); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1250 > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1251 /* increment WP */ > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1252 mhi_add_ring_element(mhi_cntrl, tre_ring); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1253 mhi_add_ring_element(mhi_cntrl, buf_ring); > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1254 > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1255 write_unlock_bh(&mhi_chan->lock); > da05b5d43f483c drivers/bus/mhi/host/main.c Bhaumik Bhatt 2023-11-07 1256 > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 @1257 return 0; > 189ff97cca53e3 drivers/bus/mhi/core/main.c Manivannan Sadhasivam 2020-02-20 1258 } >
On 11/10/2023 11:38 AM, Qiang Yu wrote: > > On 11/10/2023 12:32 AM, Manivannan Sadhasivam wrote: >> On Tue, Nov 07, 2023 at 03:16:04PM +0800, Qiang Yu wrote: >>> Ckeck mhi channel state after getting chan->lock to ensure that we only >>> queue buffer to an enabled channel and process event of an enabled >>> channel. >>> >> This commit message doesn't give proper explanation on how the >> channel can go to >> disabled state in between parse_xfer_event() and mhi_gen_tre(). >> >> - Mani > > Hi Mani. How about following commit message > > MHI channel state is protected by mhi_chan->lock. Hence, after core drops > mhi_chan->lock during processing xfer event, it can not prevent channel > state being changed if client closes channel or driver is removed at this > time. So let's check mhi channel state after getting chan->lock again > to avoid > queuing buffer to a disabled channel in xfer callback and stop processing > event of the disabled channel. Hi Mani, Have updated this commit message in V4 patch, hope get your comments. > >>> Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> >>> --- >>> drivers/bus/mhi/host/main.c | 4 ++++ >>> 1 file changed, 4 insertions(+) >>> >>> diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c >>> index a236dc2..b137d54 100644 >>> --- a/drivers/bus/mhi/host/main.c >>> +++ b/drivers/bus/mhi/host/main.c >>> @@ -672,6 +672,8 @@ static int parse_xfer_event(struct >>> mhi_controller *mhi_cntrl, >>> } >>> read_lock_bh(&mhi_chan->lock); >>> + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) >>> + goto end_process_tx_event; >>> } >>> break; >>> } /* CC_EOT */ >>> @@ -1211,6 +1213,8 @@ int mhi_gen_tre(struct mhi_controller >>> *mhi_cntrl, struct mhi_chan *mhi_chan, >>> /* Protect accesses for reading and incrementing WP */ >>> write_lock_bh(&mhi_chan->lock); >>> + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) >>> + return -EINVAL; >>> buf_ring = &mhi_chan->buf_ring; >>> tre_ring = &mhi_chan->tre_ring; >>> -- >>> 2.7.4 >>> >>> >
On 11/10/2023 11:38 AM, Qiang Yu wrote: > > On 11/10/2023 12:32 AM, Manivannan Sadhasivam wrote: >> On Tue, Nov 07, 2023 at 03:16:04PM +0800, Qiang Yu wrote: >>> Ckeck mhi channel state after getting chan->lock to ensure that we only >>> queue buffer to an enabled channel and process event of an enabled >>> channel. >>> >> This commit message doesn't give proper explanation on how the >> channel can go to >> disabled state in between parse_xfer_event() and mhi_gen_tre(). >> >> - Mani > > Hi Mani. How about following commit message > > MHI channel state is protected by mhi_chan->lock. Hence, after core drops > mhi_chan->lock during processing xfer event, it can not prevent channel > state being changed if client closes channel or driver is removed at this > time. So let's check mhi channel state after getting chan->lock again > to avoid > queuing buffer to a disabled channel in xfer callback and stop processing > event of the disabled channel. Hi Mani, Have updated this commit message in V4 patch, hope get your comments. > >>> Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> >>> --- >>> drivers/bus/mhi/host/main.c | 4 ++++ >>> 1 file changed, 4 insertions(+) >>> >>> diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c >>> index a236dc2..b137d54 100644 >>> --- a/drivers/bus/mhi/host/main.c >>> +++ b/drivers/bus/mhi/host/main.c >>> @@ -672,6 +672,8 @@ static int parse_xfer_event(struct >>> mhi_controller *mhi_cntrl, >>> } >>> read_lock_bh(&mhi_chan->lock); >>> + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) >>> + goto end_process_tx_event; >>> } >>> break; >>> } /* CC_EOT */ >>> @@ -1211,6 +1213,8 @@ int mhi_gen_tre(struct mhi_controller >>> *mhi_cntrl, struct mhi_chan *mhi_chan, >>> /* Protect accesses for reading and incrementing WP */ >>> write_lock_bh(&mhi_chan->lock); >>> + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) >>> + return -EINVAL; >>> buf_ring = &mhi_chan->buf_ring; >>> tre_ring = &mhi_chan->tre_ring; >>> -- >>> 2.7.4 >>> >>> >
diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index a236dc2..b137d54 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -672,6 +672,8 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl, } read_lock_bh(&mhi_chan->lock); + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) + goto end_process_tx_event; } break; } /* CC_EOT */ @@ -1211,6 +1213,8 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, /* Protect accesses for reading and incrementing WP */ write_lock_bh(&mhi_chan->lock); + if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) + return -EINVAL; buf_ring = &mhi_chan->buf_ring; tre_ring = &mhi_chan->tre_ring;
Ckeck mhi channel state after getting chan->lock to ensure that we only queue buffer to an enabled channel and process event of an enabled channel. Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> --- drivers/bus/mhi/host/main.c | 4 ++++ 1 file changed, 4 insertions(+)