From patchwork Fri Jun 29 16:25:20 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ohad Ben Cohen X-Patchwork-Id: 1132681 Return-Path: X-Original-To: patchwork-linux-omap@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 92739DFFEB for ; Fri, 29 Jun 2012 16:25:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932487Ab2F2QZo (ORCPT ); Fri, 29 Jun 2012 12:25:44 -0400 Received: from mail-wi0-f172.google.com ([209.85.212.172]:43422 "EHLO mail-wi0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932401Ab2F2QZn (ORCPT ); Fri, 29 Jun 2012 12:25:43 -0400 Received: by wibhm11 with SMTP id hm11so1122711wib.1 for ; Fri, 29 Jun 2012 09:25:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references :x-gm-message-state; bh=HN6MdvcjjMTCKYjNgNfWQaYbtaigSs3YiD8aLp8CexM=; b=jxH11d4kcRHfaPisi8DhBj4kytF2l60DzhjYGtTWW1S9qHqOVG3hGoyiAsZnGWsMWI voIsA8PctlLsVpH11ELiwNo5YpcrrBgXYxRKku6OXAkCRG/8INTROrvIr8C1cezlFjkS rEsSinCLqdkMSOSyxPv9y0T4L2TH6NYGfuiioTNn0nr1fwrKdSc3dRgNbtZh44jOELGq uaJp2lPkHC5YBhRt735rT6KGaTfumiCaX9gi17M4tqGUWd7pc2DRJbdloPxtseRbjX2o 7qmpzr1PA6Ug2Lg31K83AqL23TOG7gjDoOiui/qStxUJ1UG8P6L/9Li9z+vplMaJymCm rlAg== Received: by 10.180.76.135 with SMTP id k7mr5863737wiw.7.1340987142516; Fri, 29 Jun 2012 09:25:42 -0700 (PDT) Received: from localhost.localdomain (93-172-43-174.bb.netvision.net.il. [93.172.43.174]) by mx.google.com with ESMTPS id n6sm11256871wie.7.2012.06.29.09.25.40 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 29 Jun 2012 09:25:41 -0700 (PDT) From: Ohad Ben-Cohen To: , , Cc: Ohad Ben-Cohen Subject: [PATCH 2/2] rpmsg: make sure inflight messages don't invoke just-removed callbacks Date: Fri, 29 Jun 2012 19:25:20 +0300 Message-Id: <1340987120-10588-2-git-send-email-ohad@wizery.com> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1340987120-10588-1-git-send-email-ohad@wizery.com> References: <1340987120-10588-1-git-send-email-ohad@wizery.com> X-Gm-Message-State: ALoCoQni22UEyUCImPJP/n/cDWDgxMDQEhgmk94HP8xDVf8bJYmXD6ueeb9bZ2AnWCwUkcITXpHq Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org When inbound messages arrive, rpmsg core looks up their associated endpoint (by destination address) and then invokes their callback. We've made sure that endpoints will never be de-allocated after they were found by rpmsg core, but we also need to protect against the (rare) scenario where the rpmsg driver was just removed, and its callback function isn't available anymore. This is achieved by introducing a callback mutex, which must be taken before the callback is invoked, and, obviously, before it is removed. Reported-by: Fernando Guzman Lugo Signed-off-by: Ohad Ben-Cohen --- drivers/rpmsg/virtio_rpmsg_bus.c | 25 +++++++++++++++++++------ include/linux/rpmsg.h | 3 +++ 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index d89fbc1..9057621 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -245,6 +245,7 @@ static struct rpmsg_endpoint *__rpmsg_create_ept(struct virtproc_info *vrp, } kref_init(&ept->refcount); + mutex_init(&ept->cb_lock); ept->rpdev = rpdev; ept->cb = cb; @@ -342,10 +343,16 @@ EXPORT_SYMBOL(rpmsg_create_ept); static void __rpmsg_destroy_ept(struct virtproc_info *vrp, struct rpmsg_endpoint *ept) { + /* make sure new inbound messages can't find this ept anymore */ mutex_lock(&vrp->endpoints_lock); idr_remove(&vrp->endpoints, ept->addr); mutex_unlock(&vrp->endpoints_lock); + /* make sure in-flight inbound messages won't invoke cb anymore */ + mutex_lock(&ept->cb_lock); + ept->cb = NULL; + mutex_unlock(&ept->cb_lock); + kref_put(&ept->refcount, __ept_release); } @@ -839,14 +846,20 @@ static void rpmsg_recv_done(struct virtqueue *rvq) mutex_unlock(&vrp->endpoints_lock); - if (ept && ept->cb) - ept->cb(ept->rpdev, msg->data, msg->len, ept->priv, msg->src); - else - dev_warn(dev, "msg received with no recepient\n"); + if (ept) { + /* make sure ept->cb doesn't go away while we use it */ + mutex_lock(&ept->cb_lock); - /* farewell, ept, we don't need you anymore */ - if (ept) + if (ept->cb) + ept->cb(ept->rpdev, msg->data, msg->len, ept->priv, + msg->src); + + mutex_unlock(&ept->cb_lock); + + /* farewell, ept, we don't need you anymore */ kref_put(&ept->refcount, __ept_release); + } else + dev_warn(dev, "msg received with no recepient\n"); /* publish the real size of the buffer */ sg_init_one(&sg, msg, RPMSG_BUF_SIZE); diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h index 50233e3..05d0bc8 100644 --- a/include/linux/rpmsg.h +++ b/include/linux/rpmsg.h @@ -39,6 +39,7 @@ #include #include #include +#include /* The feature bitmap for virtio rpmsg */ #define VIRTIO_RPMSG_F_NS 0 /* RP supports name service notifications */ @@ -123,6 +124,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpmsg_channel *, void *, int, void *, u32); * @rpdev: rpmsg channel device * @refcount: when this drops to zero, the ept is deallocated * @cb: rx callback handler + * @cb_lock: must be taken before accessing/changing @cb * @addr: local rpmsg address * @priv: private data for the driver's use * @@ -144,6 +146,7 @@ struct rpmsg_endpoint { struct rpmsg_channel *rpdev; struct kref refcount; rpmsg_rx_cb_t cb; + struct mutex cb_lock; u32 addr; void *priv; };